AgileConfig Trust Management Vulnerability

AgileConfig is a lightweight configuration center for .NET Core-based development in the China .NET Core Community community. A trust management issue vulnerability exists in AgileConfig version 1.6.8, which stems from a hard-coded JWT Secret in the server that allows remote attackers to gain...

PT-2022-22898 · Unknown · Agileconfig

Name of the Vulnerable Software and Affected Versions: AgileConfig versions prior to 1.6.8 Description: The issue allows remote attackers to gain administrator access by utilizing a hardcoded JWT Secret in the AgileConfig Server. This can be achieved by using the generated JWT token...

PT-2022-18867 · Unknown · Cockpit Content Platform

Name of the Vulnerable Software and Affected Versions: Cockpit Content Platform versions prior to 2.2.2 Description: The issue concerns the improper removal of sensitive information before storage or transfer, and it also involves a two-factor authentication 2FA bypass. The 2FA secret is disclose...

Fedora: Security Advisory for golang-gopkg-square-jose-2 (FEDORA-2022-37aef44d1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-gopkg-square-jose-2-2.6.0-4.fc36

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. This includes support for JSON Web Encryption, JSON Web Signature, and JSON Web Token standards...

Fedora: Security Advisory for golang-gopkg-square-jose-2 (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Jwtear - Modular Command-Line Tool To Parse, Create And Manipulate JWT Tokens For Hackers

A modular command-line tool to parse, create and manipulate JSON Web TokenJWT tokens for security testing purposes. Features Complete modularity. All commands are plugins. Easy to add new plugins. Support JWS and JWE tokens. Easy interface for plugins. follow the template example Flexible token...

GHSA-3FVG-4V2M-98JF JWS and JWT signature validation vulnerability with special characters

Impact Jsrsasign supports JWSJSON Web Signatures and JWTJSON Web Token validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. For example, even if a string of non Base64URL encoding characters such...

PT-2022-17594

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 10.5.25 Description The issue concerns improper verification of cryptographic signatures. Specifically, JWS or JWT signatures with non-Base64URL encoding special characters or number escaped characters may be...

OESA-2022-1710 python-jwt security update

PyJWT is a Python library which allows you to encode and decode JSON Web Tokens JWT. \ JWT is an open, industry-standard RFC 7519 for representing claims securely between two parties. Security Fixes: PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing...

Improper Verification of Cryptographic Signature

Overview jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid ...

CVE-2020-36533

A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely...

Authentication flaw

A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely...

CVE-2020-36533

The connected sources describe CVE-2020-36533 affecting Klapp App (Cordova-based). The vulnerability arises from improper processing of the JSON Web Token (JWT) Handler, enabling weak authentication. The issue is potentially exploitable remotely. No specific affected versions, root cause details,...

CVE-2020-36533 Klapp App JSON Web Token improper authentication

A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely...

CVE-2020-36533 Klapp App JSON Web Token improper authentication

A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely...

CVE-2020-36533: Improper Authentication

A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely...

PT-2022-8984

Name of the Vulnerable Software and Affected Versions Klapp App affected versions not specified Description A vulnerability was found that affects the JSON Web Token Handler, leading to weak authentication. The issue can be exploited remotely. Recommendations At the moment, there is no informatio...

Fedora: Security Advisory for python-jwt (FEDORA-2022-4ae9110f51)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

ArgoCD Service Data Protection

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information through a...