CVE-2023-31580: Improper Certificate Validation

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

D-Link D-View 8 Hard-coded JWT Key (CVE-2023-5074)

Binary data dlinkdview8staticjwtkey.nbin...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, kubeflow-volumes-web-app, py3-tensorflow-serving-api, kubeflow-jupyter-web-app, az, jwt-tool, kubeflow-katib, py3-pipenv...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.1, az, nvidia-nsight-compute-13.2, py3.13-scanner-test-libraries, kubeflow-jupyter-web-app, kubeflow-volumes-web-app, jwt-tool, kubeflow-katib, k8s-sidecar, py3-pipenv, py3-cassandra-medusa, request-1276, py3-tensorflow-serving-api...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, kubeflow-volumes-web-app, py3-tensorflow-serving-api, kubeflow-jupyter-web-app, az, jwt-tool, kubeflow-katib, py3-pipenv...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.1, az, nvidia-nsight-compute-13.2, py3.13-scanner-test-libraries, kubeflow-jupyter-web-app, kubeflow-volumes-web-app, jwt-tool, kubeflow-katib, k8s-sidecar, py3-pipenv, py3-cassandra-medusa, request-1276, py3-tensorflow-serving-api...

Authentication Bypass

neuvector is vulnerable to Authentication Bypass. An attacker can reverse engineer a JWT token, forging a valid taken to perform malicious activity. This can lead to RCE...

JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

Impact A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. Patches Upgrade to NeuVector version 5.2.2 or later and latest Helm chart 2.6.3+....

GHSA-622H-H2P8-743X JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

Impact A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. Patches Upgrade to NeuVector version 5.2.2 or later and latest Helm chart 2.6.3+....

Fedora: Security Advisory for golang-github-nats-io-jwt-2 (FEDORA-2023-f122ea1b3e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KHealth: Information disclouser from URL parameter "access" lead to Account Takeover

The vulnerability allowed an attacker to retrieve sensitive JWT tokens from URL parameters, leading to potential account takeover. The JWT tokens were found using web crawling tools and could be used to authenticate as other users...

Control iD iDSecure Hard-coded JWT Key Authentication Bypass (CVE-2023-33371)

Binary data controlididsecurecve-2023-33371.nbin...

CVE-2023-43652

JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used ...

CVE-2023-5074 Authentication Bypass in D-Link D-View 8

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28...

CVE-2023-5074 Authentication Bypass in D-Link D-View 8

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28...

CVE-2023-5074

CVE-2023-5074 affects D-Link D-View 8, specifically version 2.0.1.28, where a static key protects the JWT used for user authentication. This design enables an authentication bypass risk by forging or manipulating tokens, effectively allowing unauthorized access to D-View 8 systems. The relevant c...

CVE-2023-22644: Generation of Incorrect Security Tokens

A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...

CVE-2023-5074: Use of Hard-coded Credentials

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28...

GHSA-79RC-JJH6-RC89 PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

Impact The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is secp384r1. Using any other cur...

PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

Impact The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is secp384r1. Using any other cur...