istio: unauthorised access to JWT protected HTTP path

An unauthorized access vulnerability was found in Istio in the servicemesh-proxy. An attacker can use this flaw to specify an HTTP path and gain unauthorized access, even if the path is configured to only be accessed with a valid JSON Web Token JWT...

CVE-2020-8595

An unauthorized access vulnerability was found in Istio in the servicemesh-proxy. An attacker can use this flaw to specify an HTTP path and gain unauthorized access, even if the path is configured to only be accessed with a valid JSON Web Token JWT. Mitigation Depending on the paths used in the...

GHSA-F6VF-PQ8C-69M4 Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash potential information disclosure or a potential authentication bypass...

CVE-2019-17195

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash potential information disclosure or a potential authentication bypass...

UBUNTU-CVE-2019-1010263

Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac. The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit...

CVE-2019-7644

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application...

PT-2019-5775 · Influxdata +3 · Influxdb +3

Name of the Vulnerable Software and Affected Versions: InfluxDB versions prior to 1.7.6 Description: The issue is related to an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go due to a JWT token having an empty SharedSecret. This allows a remote...

ahserver (>=1.0.1 <=1.2.0), aiohttp-admin (>=0.1.0a0 <=0.1.0a3) +62 more potentially affected by CVE-2018-1000814 via aiohttp-session (>=0.8.0 <=2.1.0)

aiohttp-session PYPI version =0.8.0, =1.0.1, =0.1.0a0, =1.0.0, =0.0.1, =1.4.0, =0.3.0, =0.4.3, =0.0.1, =0.1.0, =1.0.0, =0.0.1, =22.3.0, =0.0.1, =0.0.2 and more Source cves: CVE-2018-1000814 Source advisory: OSV:PYSEC-2018-35...

com.limitra.sdk:web_2.12 (>=0.0.1 <=0.0.13) potentially affected by CVE-2017-18239 via com.jason-goodwin:authentikat-jwt_2.12 (=0.4.5)

com.jason-goodwin:authentikat-jwt2.12 MAVEN version =0.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.jason-goodwin:authentikat-jwt2.12 and may be impacted: - com.limitra.sdk:web2.12 =0.0.1, =0.0.13 Source cves: CVE-2017-18239 Source advisory:...

GHSA-3RHM-67J6-42JQ Exposure of Sensitive information in authentikat-jwt

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt aka com.jason-goodwin/authentikat-jwt version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature b...

@sysdoc/sysdoc-web-stack (=1.0.0), ac-koa-hipchat (>=0.1.0 <=0.2.20) +182 more potentially affected by CVE-2016-10555 via jwt-simple (>=0.1.0 <=0.3.0)

jwt-simple NPM version =0.1.0, =0.1.0, =0.1.0, =1.1.0, =0.0.1, =0.1.0, =1.0.0, =0.0.7, =0.2.12, =0.5.3, =0.1.0, =0.0.2, =1.1.1, =1.3.1 and more Source cves: CVE-2016-10555 Source advisory: OSV:GHSA-VGRX-W6RG-8FQF...

DEBIAN-CVE-2018-1000539

Nov json-jwt version = 0.5.0 && 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. Th...

UBUNTU-CVE-2018-1000539

Nov json-jwt version = 0.5.0 && 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. Th...

PyJWT Key Obfuscation Attack Vulnerability

pyjwt is a JSON Web Token implementation in Python. PyJWT suffers from a key obfuscation vulnerability. An attacker can exploit the vulnerability to use PKCS1 PEM encoded public key users can perform symmetric/asymmetric key obfuscation attacks to create JWT from scratch...

Unspecified vulnerability in authentikat-jwt

authentikat-jwt aka com.jason-goodwin/authentikat-jwt is a JWT Scala implementation. A security vulnerability exists in the JsonWebToken.validate method of the main/scala/authentikat/jwt/JsonWebToken.scala file in authentikat-jwt 0.4.5 and earlier. No details of the vulnerability are provided at...

Unspecified Vulnerability in inversoft prime-jwt

inversoft prime-jwt is an open source Java 8-based JWT library . A security vulnerability exists in JWTDecoder.decode in versions prior to inversoft prime-jwt 1.3.0 and commit 0d94dcef0133d699f21d217e922564adbb83a227. No details of the vulnerability are provided at this time...

CVE-2018-0130

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...

Override Access Vulnerability in SiteServer CMS Administration Backend

SiteServer CMS is a web content management system developed by Beijing Billion Software Technology Development Co. A vulnerability exists in the management background of SiteServer CMS. The vulnerability is due to the background access control using JWT technology for identity authentication, HTT...

jwt-scala Cannot Verify Token Signature Vulnerability

jwt-scala is a Scala library for processing JSON Web Token JWT. A security vulnerability exists in jwt-scala 1.2.2 and earlier versions, which stems from the program failing to properly verify token signatures. A remote attacker can exploit the vulnerability to forge a signed token with specially...

CVE-2017-10862

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token...