MAL-2022-459 Malicious code in @nexthink/arm-jwt-decoder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51df48a51ecff12b69c9a30fb95f37dcd19cbf557c11e050fb5cd202e6a1d8be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-39227 affecting package python-jwt for versions less than 2.4.0-2

CVE-2022-39227 affecting package python-jwt for versions less than 2.4.0-2. A patched version of the package is available...

CVE-2022-42983

anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens...

CVE-2022-42980

go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...

CVE-2022-42983

anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens...

Authentication flaw

anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens...

Path traversal

go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...

CVE-2022-42983

CVE-2022-42983 affects anji-plus AJ-Report 0.9.8.6. The issue allows remote attackers to bypass login authentication by spoofing JWT Tokens. Impact is described as high (CVE entry indicates Network attack vector, low complexity, required privileges, no user interaction; confidentiality, integrity...

CVE-2022-42980: Use of Hard-coded Credentials

go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...

CVE-2022-42980

go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...

PT-2022-26691 · Goadmin · Go-Admin

Name of the Vulnerable Software and Affected Versions: go-admin aka GO Admin version 2.0.12 Description: The issue concerns the use of a hardcoded string 'go-admin' as a production JWT key in go-admin. Recommendations: For go-admin version 2.0.12, update the JWT key to a secure, randomly generate...

CVE-2022-42980

go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...

CVE-2022-42983

anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens...

CVE-2022-42983: Authentication Bypass by Spoofing

anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens...

CVE-2022-42980

CVE-2022-42980 affects go-admin (GO Admin) 2.0.12 where the production JWT key is the literal string "go-admin". This hardcoded value can enable token forgery and unauthorized access corresponding to the high-impact CVSS rating. The available connected sources confirm the exact vulnerability—use ...

CVE-2022-42980

go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...

Design/Logic Flaw

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...

CVE-2022-31130

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...

CVE-2022-39227 affecting package python-jwt 2.4.0-1

CVE-2022-39227 affecting package python-jwt 2.4.0-1. A patched version of the package is available...

CVE-2022-31130 Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...