3841 matches found
FortiDDoS - Use of hardcoded key for the JWT token
A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...
[SECURITY] Fedora 35 Update: python-jwt-2.4.0-1.fc35
A Python implementation of JSON Web Token draft 01. This library provides a means of representing signed content using JSON data structures, including claims to be transferred between two parties encoded as digitally signed and encrypted JSON objects...
Fedora: Security Advisory for python-jwt (FEDORA-2022-4ae9110f51)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for python-jwt (FEDORA-2022-3cf456dc20)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Improper Access Control
github.com/awake1t/linglong is vulnerable to access control bypass. The vulnerability exists in the jwt.go due to the hard coded jwt token which allows an attacker to craft a malicious cookie and gain access to the system...
CVE-2022-29217
A vulnerability was found in python-jwt. This issue happens when PyJWT supports multiple different JWT signing algorithms. This flaw allows an attacker submitting the JWT token to choose the used signing algorithm, leading to key confusion through non-blocklisted public key formats...
Broken Authentication in Atlassian Connect Express
Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...
GHSA-FFQJ-6FQR-9H24 Key confusion through non-blocklisted public key formats
Impact What kind of vulnerability is it? Who is impacted? Disclosed by Aapo Oksman Senior Security Specialist, Nixu Corporation. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requir...
Argo CD will blindly trust JWT claims if anonymous access is enabled
Impact A critical vulnerability has been discovered in Argo CD which would allow unauthenticated users to impersonate as any Argo CD user or role, including the admin user, by sending a specifically crafted JSON Web Token JWT along with the request. In order for this vulnerability to be exploited...
GHSA-R642-GV9P-2WJJ Argo CD will blindly trust JWT claims if anonymous access is enabled
Impact A critical vulnerability has been discovered in Argo CD which would allow unauthenticated users to impersonate as any Argo CD user or role, including the admin user, by sending a specifically crafted JSON Web Token JWT along with the request. In order for this vulnerability to be exploited...
GHSA-P4XH-4869-8VRG AdaptiveScale LXDUI Hardcoded JWT Secret Key
A Hardcoded JWT Secret Key in metadata.py metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system...
AdaptiveScale LXDUI Hardcoded JWT Secret Key
A Hardcoded JWT Secret Key in metadata.py metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system...
GHSA-QCVW-82HH-GQ38 Istio ReDoS Vulnerability
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API...
Istio ReDoS Vulnerability
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API...
GHSA-45FH-G845-PJ9W Auth0 Passport-SharePoint does not validate JWT signature
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms...
Auth0 Passport-SharePoint does not validate JWT signature
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms...
GO-2022-0217 Denial of service affecting P-521 and P-384 curves in crypto/elliptic
A DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU. These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some...
AZL-9852 CVE-2022-29217 affecting package python-jwt for versions less than 2.4.0-1
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...
CVE-2022-29217
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...
CVE-2022-29217
PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can...