CVE-2025-30422

A buffer overflow was addressed with improved input validation. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local network may cause an unexpected app termination...

CVE-2025-24132

The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local network may cause an unexpected app termination...

CVE-2025-30422

A buffer overflow was addressed with improved input validation. This issue is fixed in AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, CarPlay Communication Plug-in R18.1. An attacker on the local network may cause an unexpected app termination...

CVE-2025-30422

CVE-2025-30422 is a buffer overflow vulnerability in Apple’s AirPlay ecosystem (AirPlay audio SDK, AirPlay video SDK, and CarPlay Communication Plug-in). The issue, exploited by improper input handling, could allow an attacker on the same local network to trigger an unexpected application termina...

Vulnerabilities fixed in Apple AirPlay as used by macOS, iOS and iPadOS

Apple has fixed vulnerabilities in AirPlay, as used in various Apple products including macOS, iOS and iPadOS. The vulnerabilities are exploited to cause a denial-of-service, bypass authentication and execute arbitrary code. To do this, the malicious party needs to send malicious content to a...

PT-2025-18328

Name of the Vulnerable Software and Affected Versions AirPlay audio SDK versions prior to 2.7.1 AirPlay video SDK versions prior to 3.6.0.126 CarPlay Communication Plug-in versions prior to R18.1 Description A buffer overflow issue was addressed by improving input validation. This could allow an...

Malicious code in @di-sdk/quickselect-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb4f93b792159c059a742b5ea3d59a8038b8e1be1103e430086184a2f3ca3090 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-46344

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While...

CVE-2025-46344

Summary of affected component: Auth0 Next.js SDK (nextjs-auth0), version range 4.0.1 through 4.5.0. Root cause: When generating a JWE token for the session, the code does not invoke .setExpirationTime, so the JWE lacks an internal expiration claim; session cookies may expire, but the JWE remains ...

CVE-2025-46344 Auth0 NextJS SDK v4 Missing Session Invalidation

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While...

CVE-2025-46344 Auth0 NextJS SDK v4 Missing Session Invalidation

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While...

CVE-2025-46344 Auth0 NextJS SDK v4 Missing Session Invalidation

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While...

Auth0 NextJS SDK v4 Missing Session Invalidation

Overview Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. Am I Affected? You are affected if y...

GHSA-PJR6-JX7R-J4R6 Auth0 NextJS SDK v4 Missing Session Invalidation

Overview Auth0 NextJS v4.0.1 to v4.5.0 does not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. Am I Affected? You are affected if y...

PT-2025-18209 · Auth0 · Auth0 Next.Js Sdk

Name of the Vulnerable Software and Affected Versions: Auth0 Next.js SDK versions 4.0.1 through 4.5.0 Description: The issue arises from the failure to invoke .setExpirationTime when generating a JWE token for the session in the Auth0 Next.js SDK. This results in the JWE not containing an interna...

@abaplint/database-snowflake (>=2.7.93, <=2.7.101), @altimateai/datamate (>=0.0.19-beta.2, <=0.4.4) +165 more potentially affected by CVE-2025-46328 via snowflake-sdk (>=1.10.0, <=2.0.2)

snowflake-sdk NPM version =1.10.0, =2.7.93, =0.0.19-beta.2, =0.0.5, =8.0.0, =0.1.0, =0.1.0, =1.8.0, =0.0.0, =0.4.4, =0.7.17, =0.0.2, =1.0.2, =1.0.93, =0.0.0-beta.1, =0.0.36 and more Source cves: CVE-2025-46328 Source advisory: OSV:GHSA-WMJQ-JRM2-9WFR...

Malicious code in amazon-chime-sdk-js-exp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 41b8665f77f2bb83789c04cdd6973e2525d3af8609a0e4fc6f41e7b460eb1b51 The OpenSSF Package Analysis project identified 'amazon-chime-sdk-js-exp' @ 10.10.100 npm as malicious. It is considered malicious because: - Th...

MAL-2025-3376 Malicious code in amazon-chime-sdk-js-exp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 41b8665f77f2bb83789c04cdd6973e2525d3af8609a0e4fc6f41e7b460eb1b51 The OpenSSF Package Analysis project identified 'amazon-chime-sdk-js-exp' @ 10.10.100 npm as malicious. It is considered malicious because: - Th...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 8 used by AIX. AIX has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2024-21217 DESCRIPTION: Vulnerability in Java SE component: Serialization. Difficult to exploit vulnerability allows...

Multiple vulnerabilities in IBM Java SDK affect AIX

IBM SECURITY ADVISORY First Issued: Fri Apr 25 08:34:19 CDT 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/javaapr2025advisory.asc Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX...