OpenClawMachines

OpenClaw Machines 在你自己的硬件上运行任意数量的隔离 OpenClaw 代理。 OpenClaw Machines 是一个开源平台，用于在你自己的基础设施中以安全的 AI 沙箱运行OpenClaw。控制平面 编排你的主机，每个代理在自己独立的 Firecracker 微虚拟机中运行——通过硬件隔离，安全处理不可信和代理生成的代码。Cloudflare 数据平面 是前端入口：每台机器通过边缘认证获得自己的子域名，通过一条终止于 VM 内部 的隧道访问——主机无需暴露任何端口用于用户到 VM 的流量。当前的控制平面仍需要私有或防火墙限制的访问来连接每个代理在 9090...

CVE-2026-42035

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter lib/adapters/http.js that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type...

Evaluating LLM-Generated Obfuscated XSS Payloads for Machine Learning-Based Detection

Cross-site scripting XSS remains a persistent web security vulnerability, especially because obfuscation can change the surface form of a malicious payload while preserving its behavior. These transformations make it difficult for traditional and machine learning-based detection systems to reliab...

CVE-2021-29444

jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed...

@teachbase/utils (1.0.1) potentially affected by CVE-2022-36083 via jose-browser-runtime (3.16.1)

jose-browser-runtime NPM version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on jose-browser-runtime and may be impacted: - @teachbase/utils 1.0.1 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

@netceterapx/click-to-pay-embedded-sdk (>=0.0.1, <=1.0.5) potentially affected by CVE-2022-36083 via jose-browser-runtime (4.1.2)

jose-browser-runtime NPM version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on jose-browser-runtime and may be impacted: - @netceterapx/click-to-pay-embedded-sdk =0.0.1, =1.0.5 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ...

CVE-2021-29444

jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed...

CVE-2021-29444

jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed...

Design/Logic Flaw

jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed...

CVE-2021-29444

CVE-2021-29444 affects the npm package jose-browser-runtime. In versions prior to 3.11.4, the AES_CBC_HMAC_SHA2 decryption flow would execute both HMAC verification and CBC decryption even if one failed, enabling a potential padding oracle due to observable timing differences during padding error...

CVE-2021-29444 Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime

jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed...

PT-2021-18219 · Unknown · Jose-Browser-Runtime

Name of the Vulnerable Software and Affected Versions: jose-browser-runtime versions prior to 3.11.4 Description: The AES CBC HMAC SHA2 Algorithm decryption in jose-browser-runtime has a padding oracle vulnerability. This occurs because a possibly observable difference in timing when a padding...

jose-browser-runtime 安全漏洞

npm jose-browser-runtime is an application from the US company npm. Generic " JSON Web almost everything " - JWA, JWS, JWE, JWT, JWK using native encryption runtime without dependencies. A security vulnerability exists in jose-browser-runtime, which stems from the possibility of a noticeable time...