GHSA-2MQV-4J3R-VJVP Open redirect in @auth0/nextjs-auth0

Overview Versions =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users...

@perimetre/nextjs-auth (>=0.1.0, <=0.2.1), @zagrajmy/app (>=0.0.1, <=0.1.0) potentially affected by CVE-2021-43812 via @auth0/nextjs-auth0 (>=0.11.0, <=0.16.1)

@auth0/nextjs-auth0 NPM version =0.11.0, =0.1.0, =0.0.1, =0.1.0 Source cves: CVE-2021-43812 Source advisory: MEND:CVE-2021-43812...

ALPINE-CVE-2021-43803

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...

GHSA-25MP-G6FV-MQXX Unexpected server crash in Next.js.

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom...

3nit-components (>=0.0.2, <=0.0.4), 3nit-utils (>=0.3.0, <=1.0.2) +1234 more potentially affected by CVE-2021-37699 via next (>=1.2.3, <=11.0.1)

next NPM version =1.2.3, =0.0.2, =0.3.0, =0.0.0-canary.0, =0.0.1, =1.0.0, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2021-37699 Source advisory: OSV:GHSA-VXF5-WXWP-M7G9...

ZEIT Next.js Input Validation Vulnerability

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack, and Babel.js. ZEIT Next.js is vulnerable to an input validation error in versions prior to 11.1.0, which stems from a web system or product that does not properly validate input data. An attacker...

Reflected XSS from the callback handler's error query parameter

Overview Overview @auth0/nextjs-auth0 versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message. Am I affected? You are...

Cross site scripting

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

@perimetre/nextjs-auth (>=0.1.0, <=0.2.1), @zagrajmy/app (>=0.0.1, <=0.1.0) potentially affected by CVE-2021-32702 via @auth0/nextjs-auth0 (>=0.11.0, <=0.16.1)

@auth0/nextjs-auth0 NPM version =0.11.0, =0.1.0, =0.0.1, =0.1.0 Source cves: CVE-2021-32702 Source advisory: MEND:CVE-2021-32702...

CVE-2021-32702 Reflected XSS from the callback handler's error query parameter

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

PT-2021-19868

Name of the Vulnerable Software and Affected Versions @auth0/nextjs-auth0 versions prior to 1.4.2 Description The issue concerns a reflected XSS vulnerability. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter, which is then processed by the callback...

Cross-site Scripting

nextjs-auth0 lacks HTML escaping for error messages...

CVE-2021-32702: Improper Neutralization of Input During Web Page Generation

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

ZEIT Next.js Input Validation Error Vulnerability

ZEIT Next.js is a ZEIT company based on Vue.js, Node.js, Webpack and Babel.js open source Web application framework. An input validation error vulnerability exists in ZEIT Next.js. The vulnerability stems from a web system or product that does not properly validate input data. No detailed...

ZEIT Next.js path traversal vulnerability

ZEIT Next.js is a ZEIT company based on Vue.js, Node.js, Webpack and Babel.js open source Web application framework. A path traversal vulnerability exists in ZEIT Next.js versions prior to 9.3.2. The vulnerability stems from a failure of a web system or product to properly filter for special...

3nit-utils (>=0.30.0, <=1.0.2), @aller/theming (>=1.0.0, <=1.0.2) +25 more potentially affected by unknown CVE via devalue (2.0.0)

devalue NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on devalue and may be impacted: - 3nit-utils =0.30.0, =1.0.0, =1.2.1-next.3, =0.0.1, =0.1.1, =1.11.8, =4.1.1, =0.1.2, =0.1.1, =0.0.2-canary.2, =9.0.5-canary.0, =9.1.5-canary.9 and...

Next.js Cross-Site Scripting Vulnerability

Next.js is a lightweight framework for static applications. A cross-site scripting vulnerability exists in Next.js versions 7.0.0 and 7.0.1 on 404 or 500 /error pages, which can be exploited by a remote attacker to execute client-side code on these pages by sending a specially crafted request...

ZEIT Next.js Directory Traversal Vulnerability

Next.js is a minimalist server-side rendering framework for React applications. A directory traversal vulnerability exists in ZEIT Next.js versions prior to 2.4.1 under the /next and /static request namespaces. An attacker can exploit this vulnerability to obtain sensitive information...