Design/Logic Flaw

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

CVE-2022-30262

The CVE-2022-30262 entry concerns Emerson ControlWave ‘Next Generation’ RTUs (through 2022-05-02) with firmware updates transmitted over BSAP-IP. The vulnerability is insufficient verification of data authenticity: firmware images in CAB archives are not authenticated (no signing) and rely on ins...

CVE-2022-30262: Insufficient Verification of Data Authenticity

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

Unified Threat Management: The All-in-One Cybersecurity Solution

UTM Unified threat management is thought to be an all-in-one solution for cybersecurity. In general, it is a versatile software or hardware firewall solution integrated with IPS Intrusion Prevention System and other security services. A universal gateway allows the user to manage network security...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-31186 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-31186 Source advisory: OSV:GHSA-P6MM-27GQ-9V3P...

@chirpy-dev/main-app (>=0.1.0, <=0.3.0), @elastic/docsmobile (>=1.9.9, <=1.12.0) +7 more potentially affected by CVE-2022-31186 via next-auth (>=4.0.0-beta.6, <=4.9.0)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.9, =4.0.0-alpha.11, =4.0.0-alpha.1, =4.0.0-alpha.6, =0.31.1, =1.42.1, =0.50.4, =0.78.15-alpha.2 - chirpy-dev 0.1.0 Source cves: CVE-2022-31186 Source advisory: OSV:GHSA-P6MM-27GQ-9V3P...

GHSA-P6MM-27GQ-9V3P next-auth before v4.10.2 and v3.29.9 leaks excessive information into log

Impact An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log which is thrown during OAuth error handling and use it to leverage further attacks o...

next-auth before v4.10.2 and v3.29.9 leaks excessive information into log

Impact An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log which is thrown during OAuth error handling and use it to leverage further attacks o...

Contiki-NG 缓冲区错误漏洞

Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. A buffer error vulnerability exists in Contiki-NG versions prior to 4.8, which stems from insufficient validation of the IPv6 Network Neighborhood Discovery option in Contiki-NG, and c...

Contiki-NG 安全漏洞

Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. A security vulnerability exists in Contiki-NG 4.7 and earlier versions, which stems from a buffer overflow that could be caused when an attacker copies an IPv6 address prefix in the...

CVE-2022-34973

D-Link DIR820LA1FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp...

Information Disclosure

next-auth is vulnerable to information disclosure. A local authenticated attacker is able to gain access to confidential information such as identity provider's classified data from the log through error handling of oAuthCallback function...

Authorization Bypass

next-auth is vulnerable to authorization bypass. The vulnerability exists because the email verification in email provider is not properly handled, allowing an attacker to bypass the mail address and log as a newly created user into the system...

GHSA-XV97-C62V-4587 NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

Impact next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected. If an attacker could forge a request that sent a comma-separated list of emails eg.: [email protected],[email protected] to the sign-in endpoint, NextAuth.js would send emails to...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-35924 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-35924 Source advisory: OSV:GHSA-XV97-C62V-4587...

@chirpy-dev/main-app (>=0.1.0, <=0.3.0), @elastic/docsmobile (>=1.9.9, <=1.12.0) +7 more potentially affected by CVE-2022-35924 via next-auth (>=4.0.0-beta.6, <=4.9.0)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.9, =4.0.0-alpha.11, =4.0.0-alpha.1, =4.0.0-alpha.6, =0.31.1, =1.42.1, =0.50.4, =0.78.15-alpha.2 - chirpy-dev 0.1.0 Source cves: CVE-2022-35924 Source advisory: OSV:GHSA-XV97-C62V-4587...

CVE-2022-31186 Leakage of excessive information into log in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

CVE-2022-31186

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in "next-auth" before "v4.10.2" and "v3.29.9" allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the l...

PT-2022-20596 · Next-Auth · Next-Auth

Name of the Vulnerable Software and Affected Versions: next-auth versions prior to v4.10.2 next-auth versions prior to v3.29.9 Description: An information disclosure issue allows an attacker with log access privilege to obtain excessive information, such as an identity provider's secret in the lo...

CVE-2022-31186: Insertion of Sensitive Information into Log File

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...