com.codacy:codacy-seed-client-akka-http_2.11 (>=1.1.0_akka24circe08, <=1.2.0_akka25circe08), com.softwaremill.akka-http-session:jwt_2.11 (>=0.2.0, <=0.5.11) potentially affected by CVE-2020-28452 via com.softwaremill.akka-http-session:core_2.11 (>=0.2.0, <=0.5.11)

com.softwaremill.akka-http-session:core2.11 MAVEN version =0.2.0, =1.1.0akka24circe08, =0.2.0, =0.5.11 Source cves: CVE-2020-28452 Source advisory: SNYK:JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046675...

GitLab: Exposure of a valid Gitlab-Workhorse JWT leading to various bad things

Summary Using the State Uploading API we could potentially do a bad thing: - Bypass Gitlab::Workhorse.verifyapirequest! This was due to the fact that Workhorse clean the URL before passing it to Rails, this is elaborated in 923027. and State Api read request.body to append it as a file!...

CVE-2019-20933

An authentication bypass vulnerability was found in InfluxDB. By default, when using JWT authentication, InfluxDB does not generate a signing secret or state in the documentation that a JWT secret must be generated. If InfluxDB is left in the default state, this flaw allows an attacker to generat...

CVE-2020-9049

A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid...

CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

Authentication flaw

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

CVE-2019-20933

InfluxDB before 1.7.6 contains an authentication bypass in the authenticate function (services/httpd/handler.go) where a JWT token may carry an empty SharedSecret. This can allow an attacker to bypass authentication and gain unauthorized access, potentially enabling data modification or administr...

InfluxDB authentication bypass vulnerability

InfluxDB is an open source temporal database developed by InfluxData. An authentication bypass vulnerability exists in the authenticate function in services/httpd/handler.go in versions prior to InfluxDB 1.7.6. The vulnerability stems from the fact that JWT tokens may have an empty SharedSecret. ...

Denial Of Service (DoS)

github.com/nats-io/nats-server is vulnerable to denial of service DoS. An attacker can cause an application to crash by sending a malicious JWT...

CVE-2020-26521

The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...

CVE-2020-26892

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

UBUNTU-CVE-2020-26892

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

CVE-2020-26521

The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...

Code injection

The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...

Code injection

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

CVE-2020-26892

Summary : CVE-2020-26892 affects NATS nats-server before 2.1.9 due to incorrect access control from how expired credentials are handled in the JWT library. The vulnerability stems from the JWT package’s credential expiry checks, which could allow bypassing access restrictions. Affected versions i...

CVE-2020-26892

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

CVE-2020-26521

CVE-2020-26521 affects NATS server’s JWT handling: the JWT library (used by nats-server) can dereference nil during decoding, causing Denial of Service. Affected: NATS Server versions before 2.1.9. Root cause: nil dereference in Go code when processing User JWTs. Remediation: upgrade the JWT depe...