UBUNTU-CVE-2020-27839

A flaw was found in ceph-dashboard. The JSON Web Token JWT used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and...

Design/Logic Flaw

A flaw was found in ceph-dashboard. The JSON Web Token JWT used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and...

CVE-2021-22160

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user incl. admins...

Apache Pulsar Data Forgery Issue Vulnerability

Apache Pulsar is an Apache Foundation distributed messaging platform for cloud environments that integrates messaging, storage, and lightweight functional computing. The software supports multi-tenancy, persistent storage, multi-room cross-regional data replication, with strong consistency, high...

Apache Pulsar 数据伪造问题漏洞

Apache Pulsar is an Apache Foundation distributed messaging platform for cloud environments that integrates messaging, storage, and lightweight functional computing. The software supports multi-tenancy, persistent storage, multi-room cross-regional data replication, with strong consistency, high...

Red Hat Ceph跨站脚本漏洞

Red Hat Ceph is a Linux petabyte-level distributed file system from Red Hat. The main goal of the system is to be designed as a distributed file system without a single point of failure based on POSIX Portable Operating System Interface, enabling fault-tolerant and seamless replication of data. A...

Atlassian Connect Spring Boot 授权问题漏洞

Atlassian Connect Spring Boot is an application component from Atlassian Australia. A Spring Boot starter program is provided for building Atlassian Connect add-ons for JIRA Software, Service Desk and Core and Confluence. An authorization issue vulnerability exists in Atlassian Connect Spring Boo...

CVE-2020-36124

Pax Technology PAXSTORE v7.0.820200511171508 and lower is affected by XML External Entity XXE injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access the platform as any desired user clients and administrators...

Pax Technology PAXSTORE 代码问题漏洞

PAX Technology PAXSTORE is an application from China PAX PAX Inc. An ecosystem that connects 2.5 million terminals, thousands of application developers and 180+ markets in 80+ countries worldwide. An information disclosure vulnerability exists in Pax Technology PAXSTORE version v7.0.8202005111715...

GHSA-6G3C-2MH5-7Q6X Missing validation of JWT signature in `ManyDesigns/Portofino`

Impact Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. Patches The issue will be patched in the upcoming 5.2.1 release. For more information If you have any questions o...

Insecure JWT Verification

portofino-dispatcher performs insecure JWT token verification. The lack of proper JSON Web Token signature verification allows an attacker to successfully forge a JWT which would otherwise pass verification...

Luke Jordan Grassroot Platform 数据伪造问题漏洞

Luke Jordan grassroot-platform is an open source application by Luke Jordan. An application that makes it faster, cheaper and easier to sustainably organize and mobilize people in low-income communities. A security vulnerability exists in Luke Jordan Grassroot Platform that allows for the forgery...

CVE-2021-29451

Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release...

Alessio Stalla Portofino 数据伪造问题漏洞

Alessio Stalla Portofino is an Alessio Stalla open source application. A low-code tool for building model-driven REST APIs and web applications. A security vulnerability exists in Portofino version 5.2.1, which stems from . Portofino is an open source web development framework. Prior to version...

CVE-2021-22190

A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token...

UBUNTU-CVE-2021-22190

A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token...

GitLab 路径遍历漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A path traversal vulnerability exists in GitLab, which ca...

PT-2021-14901 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab affected versions not specified Description: A path traversal vulnerability via the GitLab Workhorse in GitLab could result in the leakage of a JWT token. Recommendations: At the moment, there is no information about a newer version th...

TimelyBills 安全漏洞

TimelyBills is a mobile application app from TimelyBills, Inc. a financial management software. A security vulnerability exists in TimelyBills for iOS version 1.7.0 and earlier and version 1.21.115 and earlier, which originates from plaintext storage in a file or on disk, and can be exploited by ...

PT-2021-18383 · Pomerium · Pomerium

Name of the Vulnerable Software and Affected Versions: Pomerium versions prior to 0.13.4 Description: The issue allows an outside attacker to get a signed login URL that, upon visiting it, will redirect a victim to the attacker’s site, creating an Open Redirect problem and potentially leading to...