1869 matches found
PYSEC-2024-52
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. This is similar to CVE-2022-29217 and CVE-2024-33663...
PYSEC-2024-52
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. This is similar to CVE-2022-29217 and CVE-2024-33663...
ID Charger Security Vulnerability
The Volkswagen Group ID Charger is a home all-in-one charger from Volkswagen Group Germany. A security vulnerability exists in ID Charger Connect & Pro, which stems from a misimplementation of the JWT library, and can be exploited by unauthenticated attackers to bypass the authentication mechanis...
CVE-2024-5037
A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue "iss" check during JSON web token JWT authentication...
CVE-2024-5037
A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue "iss" check during JSON web token JWT authentication...
PT-2024-4052 · Red Hat · Openshift Telemeter
Name of the Vulnerable Software and Affected Versions: OpenShift Telemeter affected versions not specified Description: The issue is related to a flaw in OpenShift's Telemeter that allows an attacker to bypass authentication using a forged token. This can be done by exploiting the "iss" check...
SUSE CVE-2020-27839
A flaw was found in ceph-dashboard. The JSON Web Token JWT used for user authentication is stored by the frontend application in the browser's localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and...
The vulnerability of the JSON Web Token authentication plugin in the Django framework’s “django-restframework-simplejwt” software platform allows a hacker to disclose sensitive information that should be protected.
The vulnerability of the JSON Web Token authentication plugin in the Django software framework relates to the lack of protection for sensitive data. Exploiting this vulnerability could allow an attacker to disclose protected information through the foruser method...
GHSA-4RR6-GF59-GGW5 namshi/jose - Verification bypass
Several widely-used JSON Web Token JWT libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys RS256, RS384, RS512, ES256, ES384, ES512...
namshi/jose - Verification bypass
Several widely-used JSON Web Token JWT libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys RS256, RS384, RS512, ES256, ES384, ES512...
PT-2024-40080 · Php-Jwt +4 · Php-Jwt +4
Name of the Vulnerable Software and Affected Versions: node-jsonwebtoken affected versions not specified pyjwt affected versions not specified namshi/jose affected versions not specified php-jwt affected versions not specified jsjwt affected versions not specified Description: The issue affects...
GHSA-3HVJ-2783-34X2 njwt Prototype Pollution vulnerability
njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method...
GHSA-9GXV-X7RP-R2HC gree/jose - "None" Algorithm treated as valid in tokens
Several widely-used JSON Web Token JWT libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys RS256, RS384, RS512, ES256, ES384, ES512...
Cyber Power Systems PowerPanel Business Edition 安全漏洞
Cyber Power Systems PowerPanel Business Edition is a suite of power management software from Cyber Power Systems, USA. The software automates the shutdown of physical and virtual infrastructures, and monitors and manages CyberPower UPS systems and network-connected PDUs Power Distribution Units. ...
"OfferBox" App uses a hard-coded secret key
Overview "OfferBox" App provided by i-plug inc. uses a hard-coded secret key for JWT CWE-321. Yuta Yamate of Rakuten Group, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact The hard-coded secret key for...
Moderate: python-jwcrypto security update
The python-jwcrypto package provides Python implementations of the JSON Web Key JWK, JSON Web Signature JWS, JSON Web Encryption JWE, and JSON Web Token JWT JOSE JSON Object Signing and Encryption standards. Security Fixes: python-jwcrypto: malicious JWE token can cause denial of service...
PYSEC-2024-233
python-jose through 3.3.0 allows attackers to cause a denial of service resource consumption during a decode via a crafted JSON Web Encryption JWE token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319...
UBUNTU-CVE-2024-33664
python-jose through 3.3.0 allows attackers to cause a denial of service resource consumption during a decode via a crafted JSON Web Encryption JWE token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319...
PT-2024-25302
Name of the Vulnerable Software and Affected Versions lua-resty-jwt version 0.2.3 Description The issue allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM. This enables them to potentially access unauthorized resources or perfor...
The vulnerability of the JWT Secret Handler component in the software for remote management of mobile devices by Headwind MDM allows a perpetrator to gain access to user data.
The vulnerability of the JWT SecretHandler component in the software for remote management of mobile devices by Headwind MDM is related to the use of rigidly encrypted credentials. Exploiting this vulnerability could allow a malicious actor to gain access to these credentials and create arbitrary...