2021 matches found
Authlib security vulnerability
Authlib is the ultimate Python library for building OAuth and OpenID Connect servers open-sourced by Authlib. A security vulnerability exists in Authlib versions prior to 1.6.5 that stems from the JOSE implementation accepting unlimited JWS/JWT headers and signature segments, which could lead to ...
CVE-2025-11290
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of...
CVE-2025-11442 JhumanJ OpnForm API Endpoint cross-site request forgery
A security flaw has been discovered in JhumanJ OpnForm up to 1.9.3. The impacted element is an unknown function of the component API Endpoint. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be...
EUVD-2016-9066
Malware in sbrugna...
EUVD-2021-0584
Malware in sbrugna...
EUVD-2017-11916
Malware in sbrugna...
EUVD-2020-24010
Malware in sbrugna...
EUVD-2018-0729
Malware in sbrugna...
EUVD-2020-20337
Malware in sbrugna...
EUVD-2025-32455
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of...
CVE-2025-11290
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of...
CVE-2025-11290
CRMEB up to version 5.6.1 is affected by CVE-2025-11290 due to the JWT HMAC Secret Handler component using a hard-coded cryptographic key when manipulating the secret argument (input default). The issue enables remote exploitation; exploitability is described as difficult, with a publicly availab...
CVE-2025-11290 CRMEB JWT HMAC Secret hard-coded key
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of...
CRMEB security vulnerabilities
CRMEB is a Java mall system that is open source by CRMEB. A security vulnerability exists in CRMEB 5.6.1 and earlier versions, which stems from the JWT HMAC Secret Handler component's use of a hard-coded encryption key for the parameter secret, which could lead to a remote attack...
PT-2025-40806
Name of the Vulnerable Software and Affected Versions CRMEB versions prior to 5.6.2 Description A security issue exists in CRMEB related to the JWT HMAC Secret Handler component. Manipulation of the secret argument with the input default leads to the use of a hard-coded cryptographic key within a...
CVE-2025-9485
The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the...
CVE-2025-9485 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()
The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the...
RockyLinux 10 : opentelemetry-collector (RLSA-2025:7479)
The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2025:7479 advisory. go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-27144 golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in...
WordPress plugin OAuth Single Sign On – SSO (OAuth Client) has a vulnerability related to data manipulation.
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A data forgery issue...