CVE-2020-1472

由 Jose Maria Ferreira 修改的 Zerologon...

POC-CVE-2018-0114

CVE-2018-0114 POC Cisco node-jose 开源库 0.11.0 之前版本中存在一个漏洞，可能允许未经认证的远程攻击者使用嵌入在令牌中的密钥重新签名令牌。该漏洞是由于 node-jose 遵循了 JSON Web 令牌（JWT）的 JSON Web 签名（JWS）标准。该标准规定，表示公钥的 JSON Web 密钥（JWK）可以嵌入到 JWS 的头部中。然后该公钥被信任用于验证。攻击者可以通过移除原始签名、向头部添加新公钥，然后使用与该 JWS 头部中嵌入的公钥相关联的（攻击者拥有的）私钥对对象进行签名，从而伪造有效的 JWS 对象进行利用。...

CVE-2018-0114

CVE-2018-0114 Cisco 的 node-jose（一个用于管理 JWT 的 JavaScript 库）中的漏洞利用。 该漏洞存在于 Cisco 的 node-jose 中，允许攻击者伪造恶意令牌。 JWT 允许用户在令牌头部嵌入公钥（使用 jwk 值）。然而，应用程序绝不应信任这些密钥，因为攻击者可以提供自己的密钥，并使用相应的私钥对消息进行签名。 回顾 该问题影响 0.11 之前版本。 如果我们查看修复此问题引入的更改...

CVE-2026-84185

CVE-2026-84185 affects the jwcrypto library, a Python implementation of the JOSE (JSON Object Signing and Encryption) standards. The flaw occurs during verification of a General JSON Serialization JWS against a key set (JWKset): due to a coding error, the library fails to correctly match the key ...

CVE-2026-85394

python-jose through version 3.5.0 contains an algorithm confusion vulnerability in its HMAC key validation logic. The library fails to properly reject DER-encoded public keys that lack PEM armor or SSH prefixes, allowing them to be accepted as HMAC secrets. An attacker who possesses the service's...

CVE-2026-85394

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

EUVD-2026-70671

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.45 packages and security update

Red Hat OpenShift Container Platform release 4.19.45 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

CVE-2018-0114-Exploit

CVE-2018-0114-利用 在 0.11.0 之前的 Cisco node-jose 开源库中存在一个漏洞，可能允许未经身份验证的远程攻击者使用嵌入在令牌中的密钥重新签署令牌。该漏洞源于 node-jose 遵循 JSON Web 令牌（JWT）的 JSON Web 签名（JWS）标准。该标准规定，代表公钥的 JSON Web 密钥（JWK）可以嵌入到 JWS 的头部中。此公钥随后被信任用于验证。攻击者可以通过移除原始签名、向头部添加新的公钥，然后使用与嵌入在该 JWS 头部中的公钥相关联的（攻击者拥有的）私钥对对象进行签名，来伪造有效的 JWS 对象。...

CVE-2018-0114

CVE-2018-0114 针对 Node-jose 0.11.0 的 Exploit，使用 Ruby 编写 使用方法 只需在代码中输入受害者名称，然后通过 ruby ./exploit.rb 运行文件 Cisco node-jose 开源库 0.11.0 之前版本中存在一个漏洞，可能允许未经身份验证的远程攻击者使用嵌入在令牌中的密钥重新签名令牌。该漏洞是由于 node-jose 遵循 JSON Web Signature JWS 标准处理 JSON Web Token JWT 所致。该标准规定，表示公钥的 JSON Web Key JWK 可以嵌入到 JWS...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.31 packages and security update

Red Hat OpenShift Container Platform release 4.21.31 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

CVE-2020-7494

creationtimestamp| type| source ---|---|--- 2026-09-01 17:01:12+00:00| seen| https://t.me/cissp/1528 2026-09-02 01:05:01+00:00| seen| https://t.me/cissp/1528...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 packages and security update

Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

RHCOS 4 : OpenShift Container Platform 4.20.36 (RHSA-2026:60444)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60444 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

RHCOS 4 : OpenShift Container Platform 4.21.31 (RHSA-2026:60449)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60449 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

POC-CVE-2018-0114

POC-CVE-2018-0114 该仓库包含针对 node-jose Stating from the last merge root@kitploit: python lib: base64,urllib,rsa,sys 运行测试 只需运行以下命令即可执行脚本： root@kitploit: python jwk-node-jose.py "payload" key-size key-size 不带大括号 作者 Andrea Cappa - 初始工作 - GitHub - Twitter Louis Nyffenegger - 支持与帮助 - Louis - 推荐； 许可...

CVE-2018-0114

CVE-2018-0114 Script de python2.7 para generación de JWT CVE-2018-0114 Una vulnerabilidad en la biblioteca de código abierto node-jose de Cisco anterior a la versión 0.11.0 podría permitir que un atacante remoto no autenticado re-firmara tokens utilizando una clave que está incrustada dentro del...