3738 matches found
CVE-2025-58761 Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The realpmsimageproxy endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The realpmsimageproxy i...
CVE-2025-58760 Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The /image API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. In Tautulli, the /image API...
Malicious code in outercore-oberon-library-jwt (npm)
The package outercore-oberon-library-jwt was found to contain malicious code...
Malicious code in perseus-postgres-jwt-config (npm)
The package perseus-postgres-jwt-config was found to contain malicious code...
Malicious code in restart-rocket-jasmine-jwt (npm)
The package restart-rocket-jasmine-jwt was found to contain malicious code...
MAL-2025-45045 Malicious code in lithosphere-eris-jwt-apollo (npm)
The package lithosphere-eris-jwt-apollo was found to contain malicious code...
MAL-2025-46440 Malicious code in umbra-archaeogenetics-exobiology-jwt (npm)
The package umbra-archaeogenetics-exobiology-jwt was found to contain malicious code...
MAL-2025-45825 Malicious code in restart-rocket-jasmine-jwt (npm)
The package restart-rocket-jasmine-jwt was found to contain malicious code...
MAL-2025-44464 Malicious code in gravity-exec-geochemistry-jwt (npm)
The package gravity-exec-geochemistry-jwt was found to contain malicious code...
Malicious code in umbra-archaeogenetics-exobiology-jwt (npm)
The package umbra-archaeogenetics-exobiology-jwt was found to contain malicious code...
Malicious code in gravity-exec-geochemistry-jwt (npm)
The package gravity-exec-geochemistry-jwt was found to contain malicious code...
Malicious code in lithosphere-eris-jwt-apollo (npm)
The package lithosphere-eris-jwt-apollo was found to contain malicious code...
MAL-2025-45542 Malicious code in perseus-postgres-jwt-config (npm)
The package perseus-postgres-jwt-config was found to contain malicious code...
MAL-2025-45495 Malicious code in outercore-oberon-library-jwt (npm)
The package outercore-oberon-library-jwt was found to contain malicious code...
CVE-2025-55739
api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...
CVE-2025-55739 api: Shared OAuth Signing Key Between Different Instances
api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
...
Linux Distros Unpatched Vulnerability : CVE-2023-51774
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes...
Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an Uncontrolled Recursion Vulnerability in Connect2id Nimbus JOSE + JWT (CVE-2025-53864)
Summary Connect2id Nimbus JOSE + JWT is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of integrating with OpenID Connect providers OIDC and is affected by an Uncontrolled Recursion Vulnerability. CVE-2025-53864. Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id...
Security Bulletin: Due to use of Connect2id Nimbus JOSE+JWT, IBM Watson Studio in Cloud Pak for Data is affected by denial of service
Summary Connect2id Nimbus JOSE+JWT is used by Watson Studio in Cloud Pak for Data. Vulnerability Details CVEID:CVE-2023-52428 DESCRIPTION: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration cou...