CVE-2022-22311

IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to improper validiation of JWT tokens...

CVE-2022-22332

IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131...

IBM Security Verify Access 输入验证错误漏洞

IBM Security Verify Access ISAM is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT, and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls,...

PT-2022-11913 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue affects Envoy, an open source edge and service proxy for cloud-native applications. A crafted request can crash Envoy when a CONNECT request is sent to the JWT filter configured wit...

Envoy 代码问题漏洞

Envoy is an open source distributed proxy server. Envoy suffers from a code issue vulnerability that stems from a crafted request crashing when a CONNECT request is sent to a JWT filter configured with regex matching in the affected version...

Zabbix - A Case Study of Unsafe Session Storage

Introduction Zabbix is a very popular open-source monitoring platform used to collect, centralize and track metrics like CPU load and network traffic across entire infrastructures. It is very similar to solutions like Pandora FMS and Nagios. Because of its popularity, features and its privileged...

CVE-2021-23207

An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ queues and messages by impersonating user...

Homer WebApp 信任管理问题漏洞

Homer WebApp is an open source Go Web application hosting the Homer-AppHep/Homer 7.7+ stack from Sipcapture in the Netherlands. A security vulnerability exists in Homer WebApp 7.x before 1.4.28, which stems from the QXIP SIPCAPTURE homer-app having the same 167f0db2-f83e-4baa-9736-d56064a5b415 JW...

CVE-2021-45389

A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864...

PT-2022-12338 · Starwind · Starwind Command Center +1

Name of the Vulnerable Software and Affected Versions: StarWind SAN and NAS build 1578 StarWind Command Center build 6864 Description: A flaw was found with the JWT token, allowing a self-signed JWT token to be injected into the update manager and bypass the authentication process, thus escalatin...

Fresenius Kabi Agilia Connect Infusion System 加密问题漏洞

The Fresenius Kabi Agilia Connect Infusion System is an infusion system from Fresenius Kabi, Germany. The Fresenius Kabi Agilia Connect Infusion System suffers from a cryptographic issue vulnerability that stems from the Vigilant MasterMed application issuing authentication tokens to authenticate...

GHSA-VPFP-5GWQ-G533 Improper Authentication in Apache ShenYu Admin

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0...

CVE-2021-24804

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site...

Exploit for Improper Authentication in Apache Shenyu

Apache ShenYu Admin has a vulnerability that allows for authenti...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An Access Control Error vulnerability exists in the WordPress Simple JWT Login plugin in versions prior to...

PT-2021-21721 · Apache · Apache Shenyu

Name of the Vulnerable Software and Affected Versions: Apache ShenYu versions 2.3.0 through 2.4.0 Description: A flaw was found in Apache ShenYu Admin, where the incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. Recommendations: For versions 2.3.0 and 2.4.0...

Apache ShenYu 授权问题漏洞

Apache ShenYu is an asynchronous, high-performance, cross-language, responsive API gateway from the Apache Foundation.An authorization issue vulnerability exists in Apache ShenYu Admin, which stems from a misuse of JWT in ShenuAdminBootstrap allowing an attacker to bypass authentication. No...

CVE-2021-41106

JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms HS256, HS384, and HS512 combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as...

CVE-2021-41106

JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms HS256, HS384, and HS512 combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as...

Design/Logic Flaw

JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms HS256, HS384, and HS512 combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as...