958 matches found
CVE-2021-43812
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as...
CVE-2021-43812
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as...
Open redirect
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as...
GHSA-2MQV-4J3R-VJVP Open redirect in @auth0/nextjs-auth0
Overview Versions =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users...
Open redirect in @auth0/nextjs-auth0
Overview Versions =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users...
CVE-2021-43812 Open redirect in nextjs-auth0
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as...
CVE-2021-43812
CVE-2021-43812 affects the Auth0 Next.js SDK. Affected: nextjs-auth0 library versions prior to 1.6.2. Issue: login URL returnTo parameter values are not filtered, allowing an open redirect. Impact: open redirect vulnerability in applications using vulnerable versions. Mitigation: upgrade to versi...
CVE-2021-43812
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as...
URL Redirection to Untrusted Site ('Open Redirect')
The Auth0 Next.js does not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue...
PT-2021-23952
Name of the Vulnerable Software and Affected Versions: Auth0 Next.js SDK versions prior to 1.6.2 Description: The issue is related to the Auth0 Next.js SDK, a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter...
CVE-2021-43812: URL Redirection to Untrusted Site
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as...
Auth0 输入验证错误漏洞
Auth0 is is an authentication agent that supports social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. An input validation error vulnerability exists in Auth0 Next.js SDK versions prior to 1.6.2 that stems from the program not filtering out...
Auth0 Express OpenId Connect 授权问题漏洞
Auth0 Express OpenId Connect is an open source component of Auth0 Inc. Express.js middleware used to protect the OpenID Connect web application. Auth0 Express OpenID Connect has an authorization issue vulnerability that stems from not regenerating the session ID and session cookie when a user log...
MiniOrange SAML Drupal Module 8.x-2.22 Privilege escalation via XML Signature Wrapping Vulnerability
Exploit Title: Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation via XML Signature Wrapping Exploit Author: Cristian 'void' Giustini Vendor Homepage: https://www.miniorange.com/ Software Link: https://www.drupal.org/project/miniorangesaml Version: 8.x-2.22 REQUIRED Tested on: Linux...
Drupal MiniorangeSAML 8.x-2.22 Privilege Escalation
Exploit Title: Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation via XML Signature Wrapping Date: 09/07/2021 Exploit Author: Cristian 'void' Giustini Vendor Homepage: https://www.miniorange.com/ Software Link: https://www.drupal.org/project/miniorangesaml Version: 8.x-2.22 REQUIRED...
Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation
Exploit Title: Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation via XML Signature Wrapping Date: 09/07/2021 Exploit Author: Cristian 'void' Giustini Vendor Homepage: https://www.miniorange.com/ Software Link: https://www.drupal.org/project/miniorangesaml Version: 8.x-2.22 REQUIRED...
Reflected XSS from the callback handler's error query parameter
Overview Overview @auth0/nextjs-auth0 versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message. Am I affected? You are...
CVE-2021-32702
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...
CVE-2021-32702
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...
Cross site scripting
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...