Malicious code in nextjs-accelerator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83f7c878f8ea9669769fb79e5abde0f57cbaa8a482dd7cf6f723e57c2eaffbfd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5397 Malicious code in polaris-example-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d2595e5124f13a673e719f1a7d7cca31d1e323960f1ee483a240227463f01be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polaris-example-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d2595e5124f13a673e719f1a7d7cca31d1e323960f1ee483a240227463f01be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ZEIT Next.js 安全漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. A security vulnerability exists in ZEIT Next.js that stems from the product's UI not restricting the display of critical information. An attacker could cause information leakage by...

Open redirect in @auth0/nextjs-auth0

Overview Versions =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users...

GHSA-2MQV-4J3R-VJVP Open redirect in @auth0/nextjs-auth0

Overview Versions =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users...

ALPINE-CVE-2021-43803

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...

GHSA-25MP-G6FV-MQXX Unexpected server crash in Next.js.

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...

3nit-components (>=0.0.2, <=0.0.4), 3nit-utils (>=0.3.0, <=1.0.2) +1234 more potentially affected by CVE-2021-37699 via next (>=1.2.3, <=11.0.1)

next NPM version =1.2.3, =0.0.2, =0.3.0, =0.0.0-canary.0, =0.0.1, =1.0.0, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2021-37699 Source advisory: OSV:GHSA-VXF5-WXWP-M7G9...

ZEIT Next.js 输入验证错误漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack, and Babel.js. ZEIT Next.js is vulnerable to an input validation error in versions prior to 11.1.0, which stems from a web system or product that does not properly validate input data. An attacker...

Reflected XSS from the callback handler's error query parameter

Overview Overview @auth0/nextjs-auth0 versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message. Am I affected? You are...

Cross site scripting

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

CVE-2021-32702 Reflected XSS from the callback handler's error query parameter

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

Cross-site Scripting

nextjs-auth0 lacks HTML escaping for error messages...

PT-2021-19868

Name of the Vulnerable Software and Affected Versions @auth0/nextjs-auth0 versions prior to 1.4.2 Description The issue concerns a reflected XSS vulnerability. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter, which is then processed by the callback...

CVE-2021-32702: Improper Neutralization of Input During Web Page Generation

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

ZEIT Next.js Input Validation Error Vulnerability

ZEIT Next.js is a ZEIT company based on Vue.js, Node.js, Webpack and Babel.js open source Web application framework. An input validation error vulnerability exists in ZEIT Next.js. The vulnerability stems from a web system or product that does not properly validate input data. No detailed...

ZEIT Next.js path traversal vulnerability

ZEIT Next.js is a ZEIT company based on Vue.js, Node.js, Webpack and Babel.js open source Web application framework. A path traversal vulnerability exists in ZEIT Next.js versions prior to 9.3.2. The vulnerability stems from a failure of a web system or product to properly filter for special...

3nit-utils (>=0.30.0, <=1.0.2), @aller/theming (>=1.0.0, <=1.0.2) +25 more potentially affected by unknown CVE via devalue (2.0.0)

devalue NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on devalue and may be impacted: - 3nit-utils =0.30.0, =1.0.0, =1.2.1-next.3, =0.0.1, =0.1.1, =1.11.8, =4.1.1, =0.1.2, =0.1.1, =0.0.2-canary.2, =9.0.5-canary.0, =9.1.5-canary.9 and...

Next.js Cross-Site Scripting Vulnerability

Next.js is a lightweight framework for static applications. A cross-site scripting vulnerability exists in Next.js versions 7.0.0 and 7.0.1 on 404 or 500 /error pages, which can be exploited by a remote attacker to execute client-side code on these pages by sending a specially crafted request...