1856 matches found
CVE-2023-48238 JWT Algorithm Confusion in json-web-token library
joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens JWT which are a compact URL-safe means of representing claims to be transferred between two parties. Versions prior to 4.0.0 are vulnerable to a JWT algorithm confusion attack. On line 86 of the 'index.js'...
JSON Web Token Security Vulnerability
JSON Web Token is a compact URL security method for representing a statement to be transmitted between two parties. A security vulnerability exists in JSON Web Token versions prior to 3.1.1 that stems from vulnerability to JWT algorithm obfuscation attacks...
GHSA-XR8C-MQ5X-5F56 Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token...
Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token...
CVE-2023-31579
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token...
CVE-2023-31579
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token...
Hardcoded credentials
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token...
Dromara Lamp-Cloud Security Breach
Dromara Lamp-Cloud is based on Jdk11 + SpringCloud + SpringBoot development of microservices in the back-end rapid development platform , focusing on multi-tenant SaaS architecture solutions , can also be used as a general project non-SaaS architecture of the basic development framework , has bee...
CVE-2023-31579
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token...
CVE-2023-31582
A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure. Mitigation No mitigation is currently available for this flaw...
CVE-2023-31580
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...
jose4j Security Feature Issue Vulnerability
jose4j is a powerful and easy-to-use open source implementation of the JSON Web Token JWT and the JOSE specification suite JWS, JWE, and JWK open sourced from Bitbucket . A security vulnerability exists in versions of jose4j prior to v0.9.3 that stems from allowing an attacker to set a low...
The vulnerability of the JWT Secret Handler component in the cloud operating system CasaOS allows a attacker to execute arbitrary commands with root privileges.
The vulnerability of the JWT Secret Handler component in the cloud operating system CasaOS is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges...
PT-2023-23657 · Neuvector · Neuvector
Name of the Vulnerable Software and Affected Versions: NeuVector versions prior to 5.2.2 Description: A user can reverse engineer the JSON Web Token JWT used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector, potentially leadi...
The vulnerability of the D-View 8 network device management platform, which stems from the use of rigidly encrypted user credentials, allows a malicious actor to circumvent security restrictions and gain unauthorized access to protected information.
The vulnerability of the D-View 8 network device management platform lies in the use of a static key during the processing of JWT tokens. Exploiting this vulnerability allows an attacker to bypass security restrictions and gain unauthorized access to protected information...
CVE-2023-5074
Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28...
CVE-2023-22644
A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...
D-Link D-View 8 Trust Management Issue Vulnerability
D-Link D-View is a web-based design network device management software from China AUO D-Link. A security vulnerability exists in D-Link D-View version 8 v2.0.1.28, which stems from the use of a static key to protect the JWT token, resulting in an authentication bypass vulnerability...
Netflix Dispatch 安全漏洞
Netflix Dispatch is a US-based Netflix company's software that provides security event management with deep integration with Slack, GSuite, Jira, etc. tools. Netflix Dispatch suffers from a security vulnerability that stems from a server response that includes the JWT key used to sign JWT tokens ...