Snyk Security Database

next is a react framework.

Affected versions of this package are vulnerable to Directory Traversal in FileSystemCache.getFilePath in packages/next/src/server/lib/incremental-cache/file-system-cache.ts. An attacker can trigger remote code execution on a Windows-hosted server by sending a request that causes the incremental cache to resolve a crafted cache key containing backslashes outside the intended cache directory. When Pages Router or App Router code runs without Cache Components on Windows, the cache path handling can write or read files outside the cache root, letting the attacker influence server-side files that the application later executes.

PyAthena is a Python DB API 2.0 (PEP 249) client for Amazon Athena

Affected versions of this package are vulnerable to SQL Injection through its escaper selection for DELETE and CREATE TABLE ... AS SELECT statements. An attacker can break out of a parameterized string literal and inject arbitrary SQL by supplying a value containing a single quote in a DELETE or CTAS query. The vulnerable code routes those statements to the Hive-style backslash escaper, but Athena/Trino parses backslashes as ordinary characters inside string literals, so the injected quote terminates the literal and lets the attacker-controlled SQL run. This can expose or modify data in the target query context and, depending on the caller’s privileges, execute destructive statements against Athena-backed tables.

org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions.

Affected versions of this package are vulnerable to Incorrect Authorization in the handling of pre-flight requests when using functional endpoints with DispatcherServlet. An attacker can bypass header-based access controls by crafting specific HTTP requests.