Oracle Linux 7 : Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne (ELSA-2020-5765)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5765 advisory. - x86/speculation: Add SRBDS vulnerability and mitigation documentation Mark Gross Orabug: 31446720 CVE-2020-0543 - x86/speculation: Add Special Regist...

Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. As of commit c9aa2eeb9 access tokens which fail validation are rejected...

Malicious code in mmolecule-jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38ee4cf4e2d60c8205a3694a176b3c7cdfc50bfa373634a0d09a2a5d228e0a7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in mmolecule-jwt

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-7970 Malicious code in mmolecule-jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38ee4cf4e2d60c8205a3694a176b3c7cdfc50bfa373634a0d09a2a5d228e0a7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-5389 · D Link · D-Link D-View 8

Name of the Vulnerable Software and Affected Versions: D-Link D-View 8 version 2.0.1.28 Description: The issue is related to the use of a static key for protecting JWT tokens in user authentication, which can allow an attacker to bypass security restrictions and gain unauthorized access to...

CVE-2023-40171

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic Authentication Provider plugin encounters an error when attempting to decode a JWT token. Any Dispatch users...

Design/Logic Flaw

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic Authentication Provider plugin encounters an error when attempting to decode a JWT token. Any Dispatch users...

CVE-2023-40171 Dispatch writes JWT tokens in error message

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic Authentication Provider plugin encounters an error when attempting to decode a JWT token. Any Dispatch users...

CVE-2023-40171 Dispatch writes JWT tokens in error message

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic Authentication Provider plugin encounters an error when attempting to decode a JWT token. Any Dispatch users...

CVE-2023-40171

CVE-2023-40171 affects the Dispatch open‑source security incident management tool. The server response includes the JWT secret used to sign tokens in errors raised by the Dispatch Plugin - Basic Authentication Provider, enabling an attacker to craft valid JWTs and potentially take over any accoun...

CVE-2023-40171 Dispatch writes JWT tokens in error message

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic Authentication Provider plugin encounters an error when attempting to decode a JWT token. Any Dispatch users...

CVE-2023-40171

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic Authentication Provider plugin encounters an error when attempting to decode a JWT token. Any Dispatch users...

CVE-2023-40171: Generation of Error Message Containing Sensitive Information

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic Authentication Provider plugin encounters an error when attempting to decode a JWT token. Any Dispatch users...

PT-2023-27303 · Dispatch · Dispatch Plugin - Basic Authentication Provider +1

Name of the Vulnerable Software and Affected Versions: Dispatch versions prior to 20230817 Description: Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the Dispatch Plugin - Basic...

CVE-2023-39846

An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...

Authentication flaw

An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...

CVE-2023-39846: Improper Authentication

An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...

CVE-2023-39846

An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...

PT-2023-27130

Name of the Vulnerable Software and Affected Versions Konga version 0.14.9 Description An issue in Konga allows attackers to bypass authentication via a crafted JWT token. Recommendations For Konga version 0.14.9, update to a version that fixes the authentication bypass issue. At the moment, ther...