CVE-2022-22967

CVE-2022-22967 affects SaltStack Salt prior to 3002.9, 3003.5, and 3004.2. The issue is that PAM authentication fails to reject locked accounts, allowing a previously authorized user with an active or API session to run Salt commands even when the account is locked (including salt-api via PAM eau...

@app-box/web (=1.0.0), @comet/cms-site (>=3.0.0-canary.160.0 <=4.0.0-canary.1049.0) +33 more potentially affected by CVE-2022-31093 via next-auth (>=0.0.0-manual.83c4ebd1 <=3.29.10)

next-auth NPM version =0.0.0-manual.83c4ebd1, =3.0.0-canary.160.0, =2.0.1-canary.24.0, =1.0.99-0.next12, =0.1.0, =0.46.0, =0.30.0, =0.3.0, =0.10.0, =0.2.0, =0.3.0, =0.3.0, =0.4.0, =0.1.0, =0.1.3 and more Source cves: CVE-2022-31093 Source advisory: OSV:GHSA-G5FM-JP9V-2432...

GHSA-G5FM-JP9V-2432 Improper Handling of `callbackUrl` parameter in next-auth

Impact An attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally we convert to a URL object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led t...

MAL-2022-793 Malicious code in @zeos-libs/auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eee22ec16fe8410ba0fa17b116c3f3bc6c12ac2f37d88e9e81e5cc13ac891467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zeos-libs/auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eee22ec16fe8410ba0fa17b116c3f3bc6c12ac2f37d88e9e81e5cc13ac891467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2738 Malicious code in energy-phoenix-core-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc673c34e7bea5924e7599982f2bd50d123ea9adef3dff7d4a086d415638d275 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nestjs-ldap-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d65363e22ae6934a381048355dec14bb6b668cfc1d21b311be5ed9d15cd12bf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4801 Malicious code in nestjs-ldap-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d65363e22ae6934a381048355dec14bb6b668cfc1d21b311be5ed9d15cd12bf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tc-auth-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e722d89065a127384cb8d7ddb06f638b99851957d770f59e19f214e17ea122f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6426 Malicious code in tc-auth-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e722d89065a127384cb8d7ddb06f638b99851957d770f59e19f214e17ea122f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in c42-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8943732b1a8e4e4090c205e69019c0013b13d3e6922448663eff7dfd8718a4fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1751 Malicious code in c42-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8943732b1a8e4e4090c205e69019c0013b13d3e6922448663eff7dfd8718a4fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3776 Malicious code in idnnnms-widget-auth-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2d88993f3efd7188328e5518c6b2c91a51f857df272820e8a2c4fced28c1fcc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in idnnnms-widget-auth-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2d88993f3efd7188328e5518c6b2c91a51f857df272820e8a2c4fced28c1fcc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mailru-auth-gate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4931b2764b279ed60d329913f78b0aa1f1b8b9c9536131bd23cc5abdb3a88ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4458 Malicious code in mailru-auth-gate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4931b2764b279ed60d329913f78b0aa1f1b8b9c9536131bd23cc5abdb3a88ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mitui-util-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37eb7e507c2a647d4f8df96f50ae1f9ab84586589d991e3aad99610a0fc98c1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4626 Malicious code in mitui-util-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37eb7e507c2a647d4f8df96f50ae1f9ab84586589d991e3aad99610a0fc98c1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mason-auth-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a7e13ffcc348e9c23720985748eb11d9c351ea990d48320c82ea6beac425536 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4487 Malicious code in mason-auth-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a7e13ffcc348e9c23720985748eb11d9c351ea990d48320c82ea6beac425536 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...