6559 matches found
CVE-2020-28042
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature...
CVE-2020-28042: Improper Verification of Cryptographic Signature
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature...
atlassian-jwt-auth (1.0.9) potentially affected by CVE-2020-25659 via cryptography (0.9.1)
cryptography PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 1.0.9 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...
cloudmesh-client (>=4.5.0, <=4.7.3), django-ca (>=1.5.0, <=1.5.1) +5 more potentially affected by CVE-2020-25659 via cryptography (1.7.2)
cryptography PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - cloudmesh-client =4.5.0, =1.5.0, =0.5.1, =1.0.0, =5.4.0, =2.2.2, =0.7.0, =0.7.3 Source cves: CVE-2020-25659 Source advisory:...
atlassian-jwt-auth (>=2.2.0, <=2.4.0) potentially affected by CVE-2020-25659 via cryptography (1.2.1)
cryptography PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.2.0, =2.4.0 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...
atlassian-jwt-auth (>=2.5.1, <=2.8.0), data-pipeline (>=0.9.5, <=0.9.12) potentially affected by CVE-2020-25659 via cryptography (1.3.4)
cryptography PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.5.1, =0.9.5, =0.9.12 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...
atlassian-jwt-auth (2.1.1), pyupdater (1.1.8) potentially affected by CVE-2020-25659 via cryptography (1.1.1)
cryptography PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.1.1 - pyupdater 1.1.8 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...
atlassian-jwt-auth (3.1.0), igitt (>=0.4.1.dev20171005105713, <=0.4.1.dev20171202111001) +4 more potentially affected by CVE-2020-25659 via cryptography (2.0.3)
cryptography PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 3.1.0 - igitt =0.4.1.dev20171005105713, =0.3.2, =0.1.4, =1.4.5, =1.4.9 Source cves: CVE-2020-25659 Source advisory:...
atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2020-25659 via cryptography (1.0.2)
cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...
atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2020-25659 via cryptography (1.2.3)
cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V476...
atlassian-jwt-auth (>=2.8.1, <=2.10.0), fallixy (0.18.1) +3 more potentially affected by CVE-2020-25659 via cryptography (1.5.3)
cryptography PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.8.1, =0.18.1, =0.9.0, =1.1.0 - teamvault 0.6.0 Source cves: CVE-2020-25659 Source advisory: OSV:GHSA-HGGM-JPG3-V47...
Regression in JWT Signature Validation
Overview Affected versions of this package are vulnerable to Regression in JWT Signature Validation. It improperly validates the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and...
Authorization Bypass
omniauth-auth0 is vulnerable to authorization bypass. The vulnerability exists through a regression made in code that validates JWT token signatures, where it is possible to bypass authentication and authorization when the default Authorization Code Flow is not used...
CVE-2020-15240
omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...
Authorization
omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...
CVE-2020-15240
omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...
CVE-2020-15240
Removed by vendor...
CVE-2020-15240
Summary: The vulnerability CVE-2020-15240 affects the Ruby gem omniauth-auth0 (versions >= 2.3.0 and
CVE-2020-15240 Regression in JWT Signature Validation
omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...
PT-2020-14305
Name of the Vulnerable Software and Affected Versions omniauth-auth0 versions 2.3.0 through 2.4.0 Description The issue concerns improper validation of the JWT token signature when using the jwt validator.verify method, potentially allowing an attacker to bypass authentication and authorization...