CVE-2022-23540

In versions "=8.5.1" of "jsonwebtoken" library, lack of algorithm definition in the "jwt.verify" function can lead to signature validation bypass due to defaulting to the "none" algorithm for signature verification. Users are affected if you do not specify algorithms in the "jwt.verify" function...

GHSA-QWPH-4952-7XR6 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Overview In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Am I affected? You will be affected if all the followi...

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Overview In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Am I affected? You will be affected if all the followi...

jsonwebtoken unrestricted key type could lead to legacy keys usage

Overview Versions =8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. Am I affected? You are affected if you are using an algorithm and a key type other than the...

GHSA-8CF7-32GW-WR33 jsonwebtoken unrestricted key type could lead to legacy keys usage

Overview Versions =8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. Am I affected? You are affected if you are using an algorithm and a key type other than the...

jsonwebtoken: Data forgery vulnerability

jsonwebtoken is Auth0 open source implementation of a JSON Web token . jsonwebtoken version 8.5.1 and earlier versions of data forgery vulnerability , the vulnerability stems from the default use of the "none" algorithm for signature verification , jwt.verify function in the lack of algorithm...

CVE-2022-23540: Improper Authentication

In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify function. This issu...

CVE-2022-23539: Use of a Broken or Risky Cryptographic Algorithm

Versions =8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the...

PT-2022-16061

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions =8.5.1 Description The issue arises from the lack of algorithm definition in the jwt.verify function, leading to a signature validation bypass due to defaulting to the none algorithm for signature verification. This occur...

CVE-2022-22461: Use of a Broken or Risky Cryptographic Algorithm

IBM Security Verify Governance, Identity Manager 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225007...

CVE-2022-38391: Use of a Broken or Risky Cryptographic Algorithm

IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 233982...

CVE-2022-4610

A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this...

Design/Logic Flaw

A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this...

CVE-2022-4610 Click Studios Passwordstate risky encryption

A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this...

Python DoS Vulnerability (Oct 2022) - Windows

Python is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...

CVE-2022-4610

Technical details for CVE-2022-4610 are not publicly available in the provided documents. Monitor for updates.

PT-2022-27737

Name of the Vulnerable Software and Affected Versions Click Studios Passwordstate affected versions not specified Click Studios Passwordstate Browser Extension Chrome affected versions not specified Description A problematic vulnerability has been found, affecting some unknown functionality. The...

CVE-2022-4610: Use of a Broken or Risky Cryptographic Algorithm

A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this...

CVE-2022-46833

Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the...

CVE-2022-46834

Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the...