Jose-php Information Disclosure Vulnerability

jose-php is suitable for PHP JSON object signature and encryption library . A security vulnerability exists in versions of jose-php before 2.2.1, due to the lack of a random padding mechanism in the implementation of the RSA 1.5 algorithm in the JWE.php/JOSEJWE class. A remote attacker can obtain...

CVE-2016-5430

The RSA 1.5 algorithm implementation in the JOSEJWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

CVE-2016-5429

jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...

CVE-2016-5429

jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...

Information disclosure

jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...

CVE-2016-5429

CVE-2016-5429 concerns the jose-php library prior to 2.2.1, where non-constant-time HMAC comparisons in the implementation (notably in JWE.php and JWS.php) can enable remote attackers to glean sensitive data via timing attacks. Public sources consistently state that the vulnerability enables info...

CVE-2016-5429

jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...

CVE-2016-5430

The CVE-2016-5430 entry affects jose-php prior to 2.2.1, where the RSA-1.5 implementation in JOSE_JWE/JWE.php lacks a Random Filling protection mechanism. This omission enables a remote attacker to obtain plaintext data via a Million Message Attack (MMA). Affected component: jose-php’s JWE.php wi...

PT-2016-6425

Name of the Vulnerable Software and Affected Versions jose-php versions prior to 2.2.1 Description The issue makes it easier for remote attackers to obtain sensitive information via a timing attack. This is related to the files JWE.php and JWS.php, where the software does not use constant-time...

CVE-2016-5429: Exposure of Sensitive Information to an Unauthorized Actor

jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php...

CVE-2016-5430: Exposure of Sensitive Information to an Unauthorized Actor

The RSA 1.5 algorithm implementation in the JOSEJWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

PT-2016-6426

Name of the Vulnerable Software and Affected Versions jose-php versions prior to 2.2.1 Description The issue concerns the RSA 1.5 algorithm implementation in the JOSE JWE class, which lacks the Random Filling protection mechanism. This makes it easier for remote attackers to obtain cleartext data...

firefox: multiple issues

CVE-2016-1952 CVE-2016-1953 arbitrary code execution Mozilla developers fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough...

tools.cisco.com Cross Site Scripting

Exploit Title: Cisco.com sub-domain Reflected XSS RXSS Date: 31/10/2015 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.cisco.com Version: / Category: Reflected Cross Site Scripting Google dork: Tested on: cisco.com sub-domains Cisco description :...

namshi/jose input validation vulnerability

namshi/jose is a PHP library for processing JSON Web markup . A security vulnerability exists in namshi/jose. A remote attacker can exploit the vulnerability to bypass signature verification via a specially crafted token in a JSON Web Tokens JWT header...

Design/Logic Flaw

NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...

CVE-2015-2964

CVE-2015-2964 affects namshi/jose (PHP JWT library). A vulnerability in processing JWT headers allows bypass of signature verification, enabling specially crafted tokens to be treated as valid data. Public sources indicate the library did not properly enforce signature checks (e.g., issues with t...

CVE-2015-2964

NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...

CVE-2015-2964: Improper Input Validation

NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...

PT-2015-6012

Name of the Vulnerable Software and Affected Versions NAMSHI | JOSE versions 5.0.0 and earlier Description The issue allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header. Recommendations For versions 5.0.0 and earlier, at the moment, there is...