5411 matches found
Authentication Bypass
Overview All versions of express-laravel-passport are vulnerable to an Authentication Bypass. The package fails to properly validate JWTs, allowing attackers to send HTTP requests impersonating other users. Recommendation Upgrade to version 2.0.5 or later. References - HackerOne Report - GitHub...
Token Validation Bypass
express-laravel-passport is vulnerable to token validation bypass. The vulnerability exists as it does not validate the JWT tokens provided by the users, allowing attackers to impersonate users by manipulating the token and submitting forged JWT tokens during authentication...
Genasys Technologies: Missing redaction on a disclosed report
Hi team, I wasn't sure if this worth a report, but I thought that you should be aware and HackerOne's support referred me to submit a report. I ran into a diclosed report where the reporter asked to redact his email but we can still extract his email and more info about his google account from th...
Security Bulletin: JWT Token Check Vulnerability in Watson Studio Local
Summary An error in how JWT token signature was checked has been addressed. This issue was leading to invalid Jupyter Notebook access. Vulnerability Details Third Party Entry: PSIRT-ADV0010959 DESCRIPTION: CVSS Base score: 5.9 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected...
Node.js third-party modules: [express-laravel-passport] Improper Authentication
I would like to report Improper Authentication in express-laravel-passport It allows to forge user's identity Module module name: express-laravel-passport version: 1.1.2 npm page: https://www.npmjs.com/package/express-laravel-passport Module Description You want a middleware support express get...
JSON-jwt Gem lacked element count during splitting of JWE string
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
GHSA-CFF7-6H4Q-Q5PJ JSON-jwt Gem lacked element count during splitting of JWE string
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
json-jwt improper input validation due to lack of element count when splitting string
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
Denial Of Service (DoS)
json-jwt is vulnerable to denial of service. The lack of element counts during a JWE string splitting can lead to an application crash when more than expected number of elements exists in the JWE string. This vulnerability could potentially allow for the bypass of the signature validation...
Node.js third-party modules: [authmagic-timerange-stateless-core] Improper Authentication
I would like to report Improper Authentication in authmagic-timerange-stateless-core It allows to forge user's identity. Module module name: authmagic-timerange-stateless-core version: 0.0.9 npm page: https://www.npmjs.com/package/authmagic-timerange-stateless-core Module Description Stateless an...
CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
DEBIAN-CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
Design/Logic Flaw
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
UBUNTU-CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
CVE-2019-18848
CVE-2019-18848 affects the rubygem-json-jwt library for Ruby, where versions prior to 1.11.0 fail to enforce an element count when splitting a JWE string. This is documented across multiple advisories (Debian DLA-2390-1, openSUSE/SUSE advisories) indicating the issue and references to upgrading t...
