852 matches found
Apache Pulsar JSON Web Token Authentication Bypass (CVE-2021-22160)
An authentication bypass vulnerability exists in the JSON Web Token authentication module of Apache Pulsar. The vulnerability is due to improper handling of unsigned JSON Web Tokens...
The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar lies in the improper verification of the cryptographic signature. This allows attackers to gain unauthorized access to protected information.
The vulnerability of the cloud-based messaging and streaming communication platform Apache Pulsar is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...
GHSA-3CV4-XXV7-934Q Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlow
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...
Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlow
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...
Authentication Bypass
pulsar-broker-common is vulnerable to authentication bypass. The JSON Web Token JWT is not validated when authenticating clients using JWT and allows an attacker to authenticate and access the application as any user...
CVE-2021-22160
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...
CVE-2021-22160
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...
Code injection
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...
CVE-2021-22160
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...
CVE-2021-22160
CVE-2021-22160 affects Apache Pulsar. The issue is that when JWT-based client authentication is used, the token signature is not validated if the token’s alg is set to none, allowing an attacker to imitate any user (including admins). The connected Red Hat and OSV entries corroborate the same des...
CVE-2021-22160 Authentication with JWT allows use of “none”-algorithm
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...
CVE-2021-22160
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...
Apache Pulsar Data Forgery Issue Vulnerability
Apache Pulsar is an Apache Foundation distributed messaging platform for cloud environments that integrates messaging, storage, and lightweight functional computing. The software supports multi-tenancy, persistent storage, multi-room cross-regional data replication, with strong consistency, high...
CVE-2021-22160: Improper Verification of Cryptographic Signature
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...
Apache Pulsar 数据伪造问题漏洞
Apache Pulsar is an Apache Foundation distributed messaging platform for cloud environments that integrates messaging, storage, and lightweight functional computing. The software supports multi-tenancy, persistent storage, multi-room cross-regional data replication, with strong consistency, high...
PT-2021-3274
Name of the Vulnerable Software and Affected Versions Apache Pulsar affected versions not specified Description The issue is related to the authentication mechanism in Apache Pulsar when using JSON Web Tokens JWT for client authentication. If the algorithm of the presented token is set to "none",...
Unspecified vulnerability in Apache Pulsar manager
Apache Pulsar is the Apache Foundation for cloud environments , set of messages , storage , lightweight functional computing as one of the distributed message flow platform . The software supports multi-tenancy, persistent storage, multi-machine room cross-region data replication, with strong...
CVE-2020-17520
In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verification mechanism by constructing special URLs, thereby accessing any HTTP API...
CVE-2020-17520
In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verification mechanism by constructing special URLs, thereby accessing any HTTP API...
Authentication flaw
In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verification mechanism by constructing special URLs, thereby accessing any HTTP API...