PT-2023-27257 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to the modify for next stage function in fdt.rs, where improperly used crypto could render KASLR ineffective. This could lead to...

The vulnerability of the next_token function in the awk.c file of the UNIX utility command-line tool BusyBox, which allows a hacker to cause a service failure

The vulnerability of the nexttoken function in the BusyBox command-line utility library of UNIX systems is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a system failure...

AZL-34577 CVE-2023-42366 affecting package busybox for versions less than 1.36.1-9

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the nexttoken function at awk.c:1159...

AZL-33492 CVE-2023-42366 affecting package busybox for versions less than 1.35.0-12

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the nexttoken function at awk.c:1159...

UBUNTU-CVE-2023-42366

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the nexttoken function at awk.c:1159...

PT-2023-7297

Name of the Vulnerable Software and Affected Versions BusyBox version 1.36.1 Description A heap-buffer-overflow issue was discovered in the next token function at awk.c:1159. This issue is related to writing beyond the buffer boundaries. Exploitation of this issue may allow an attacker to cause a...

CVE-2023-42366

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the nexttoken function at awk.c:1159...

Fedora: Security Advisory for audiofile (FEDORA-2023-07669abb35)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/main-app (>=0.1.0, <=0.3.0) +34 more potentially affected by CVE-2023-48309 via next-auth (>=4.0.0-beta.6, <=4.24.4)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.9, =0.1.0-0, =1.0.0, =1.0.0, =4.0.0-alpha.11, =4.0.0-alpha.1, =4.0.0-alpha.6, =0.6.1, =0.0.0-350929255, =1.11.1-ee257e05.17 and more Source cves: CVE-2023-48309 Source advisory: OSV:GHSA-V64W-49XW-QQ89...

Possible user mocking that bypasses basic authentication

Impact next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the...

GHSA-V64W-49XW-QQ89 Possible user mocking that bypasses basic authentication

Impact next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the...

CVE-2023-48309 next-auth vulnerable to possible user mocking that bypasses basic authentication

NextAuth.js provides authentication for Next.js. next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth...

PT-2023-30771

Name of the Vulnerable Software and Affected Versions next-auth versions prior to 4.24.5 Description A vulnerability in next-auth allows a bad actor to create an empty/mock user by obtaining a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow and manually overriding the...

CVE-2023-48309: Improper Authorization

NextAuth.js provides authentication for Next.js. next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth...

Intel NUC Security Vulnerability

Intel NUC is a small minicomputer from Intel Corporation USA. A security vulnerability exists in Intel NUC. An attacker could exploit this vulnerability to cause elevation of privilege, denial of service, and information disclosure...

PaperCut MF and PaperCut NG Security Vulnerabilities

PaperCut MF and PaperCut NG are both products of PaperCut Australia.PaperCut MF is a multifunctional printer control software.PaperCut NG is a next-generation printer control software.PaperCut MF is a multifunctional printer control software.PaperCut NG is a next-generation printer control...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM SDK, Java Technology Edition Quarterly CPU - Apr 2023 - Includes Oracle April 2023 CPU plus CVE-2023-2597

Summary All applicable Java SE CVEs published by Oracle as part of their April 2023 Critical Patch Update plus CVE-2023-2597. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been addressed in this bulletin: ELM Installer, IBM Engineering Lifecycle...

kernel: device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()

In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnodegraphgetnextendpoint The 'parent' returned by fwnodegraphgetportparent with refcount incremented when 'prev' is not NULL, it needs be put when finish using it. Because the paren...

PT-2025-37562

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference issue was identified and resolved in the Linux kernel's raw get next function. This issue stemmed from parallel execution sequences potentially freeing a socket while...

Fedora 39 : bind9-next (2023-1c069009b8)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1c069009b8 advisory. - Upstream release notes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...