Improper Handling of `callbackUrl` parameter in next-auth

Impact An attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally we convert to a URL object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led t...

GHSA-G5FM-JP9V-2432 Improper Handling of `callbackUrl` parameter in next-auth

Impact An attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally we convert to a URL object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led t...

GHSA-H4W9-6X78-8VRJ Argo CD's external URLs for Deployments can include JavaScript

Impact All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting XSS bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions up to and including admin. The scri...

[SECURITY] Fedora 35 Update: python3-docs-3.10.5-1.fc35

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

MAL-2022-6538 Malicious code in textlint-checker-for-vuejs-jp-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c21eae78309ce5b4b1c69686fd2f5d09040ea07b938b6f0a380733599f94d2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uxp-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2ee975f6346463b5281c76664a5ff62035a901c54c34ab02c586ce0031f4ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6882 Malicious code in uxp-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2ee975f6346463b5281c76664a5ff62035a901c54c34ab02c586ce0031f4ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-2130

creationtimestamp| type| source ---|---|--- 2022-06-20 12:26:18+00:00| seen| https://t.me/cibsecurity/44811 2024-11-27 11:46:27+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-2130.yaml...

Malicious code in redux-data-model-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53b5812f64dc0e890eccf730c2030854531411dc41a95fa540bd122043cbcc01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OPENSUSE-SU-2022:10016-1 Security update for firejail

This update for firejail fixes the following issues: firejail was updated to version 0.9.70: - CVE-2022-31214 - root escalation in --join logic boo1199148 Reported by Matthias Gerstner, working exploit code was provided to our development team. In the same time frame, the problem was independentl...

Metasploit Weekly Wrap-Up

vCenter Secret Extracter Expanding on the work of the vcenterforgesamltoken auxiliary module, community contributor npm-cesium137-io has added a new module for extracting the vmdir/vmafd certificates, the IdP keypair, the VMCA root cert, and anything from vmafd that has a private key associated,...

Generated code can read and write out of bounds in safe code

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit...

GHSA-3JCH-9QGP-4844 Generated code can read and write out of bounds in safe code

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit...

CVE-2022-32155

CVE-2022-32155 concerns Splunk Universal Forwarder management services. The issue described in the sources is that versions before 9.0 expose management services remotely by default, creating a potential exposure rather than a technical vulnerability. Splunk 9.0 binds the management port to local...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.308.9 - x86/speculation/mmio: Fix late microcode loading Patrick Colp Orabug: 34276099 5.4.17-2136.308.8 - Add debugfs for controlling MMIO state data Kanth Ghatraju Orabug: 34202259 CVE-2022-21123 CVE-2022-21125 CVE-2022-21127 CVE-2022-21166 - KVM: x86/speculation: Disable Fill buffe...

The vulnerability in the implementation of the EncryptInterceptor class of the Apache Tomcat application server allows a hacker to cause a service failure.

The vulnerability of the EncryptInterceptor class implementation in Apache Tomcat applications is related to incomplete documentation regarding program execution. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2022-31045

creationtimestamp| type| source ---|---|--- 2022-06-10 00:33:44+00:00| seen| https://t.me/cibsecurity/44153 2025-07-25 01:12:22+00:00| seen| https://gist.github.com/ferasdour/504aa49686f8e64564249de44cd5eab2...

CVE-2022-1970

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: The originally reported issue in https://github.com/syedsohaibkarim/OpenRedirect-Keycloak18.0.0 is a known misconfiguration, and recommendation already exists in the Keycloak documentation to...

GHSA-R7V4-JWX9-WX43 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator

Background CILogon is a federated auth provider that allows users to authenticate themselves via a number of Identity Providers IdP, focused primarily on educational and research institutions such as Universities. More traditional and open IdPs such as GitHub, ORCID, Google, Microsoft, etc are al...

CVE-2021-42887

creationtimestamp| type| source ---|---|--- 2022-06-03 16:26:30+00:00| seen| https://t.me/cibsecurity/43814 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-42887.yaml...