23 matches found
CLSA-2026-1774570940 TuxCare security update for express-jwt (1 CVE)
TuxCare rebuilt express-jwt to address 1 CVE. Fixed in 0.1.3-tuxcare.1...
CLSA-2026-1774570939 TuxCare security update for express-jwt (1 CVE)
TuxCare rebuilt express-jwt to address 1 CVE. Fixed in 0.1.4-tuxcare.1...
PT-2026-74159
TuxCare rebuilt express-jwt to address 1 CVE. Fixed in 0.1.4-tuxcare.1...
PT-2026-74160
TuxCare rebuilt express-jwt to address 1 CVE. Fixed in 0.1.3-tuxcare.1...
ROOT-APP-NPM-CVE-2020-15084 CVE-2020-15084 in @rootio/express-jwt - Patched by Root
Root has patched CVE-2020-15084 in the @rootio/express-jwt package for Root:npm. Multiple fixed versions available...
EUVD-2020-0463
Malware in sbrugna...
Malicious code in colors-express-jwt-corvus (npm)
The package colors-express-jwt-corvus was found to contain malicious code...
CVE-2020-15084
In express-jwt NPM package up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this...
MAL-2024-7771 Malicious code in express-jwt-v6 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fe7d6a9d5298553234316cd7fd21bd7ac74d55c02a1e156505dd54dc8944e648 The OpenSSF Package Analysis project identified 'express-jwt-v6' @ 6.0.6 npm as malicious. It is considered malicious because: - The package...
Malicious code in express-jwt-v6 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fe7d6a9d5298553234316cd7fd21bd7ac74d55c02a1e156505dd54dc8944e648 The OpenSSF Package Analysis project identified 'express-jwt-v6' @ 6.0.6 npm as malicious. It is considered malicious because: - The package...
Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities
Summary RamdaCVE-2021-42581 is vulnerable to remote attackers to execute arbitrary code on the system, caused by a prototype pollution in functions. An attacker could exploit this vulnerability to execute arbitrary code on the system. Node-forgeCVE-2022-24773, 217313, CVE-2022-24771, CVE-2020-772...
Authorization Bypass
express-jwt is vulnerable to authentication bypass. The algorithms entry which are to be specified in the configuration are not enforced and when they are not specified in the configuration, it can lead to authorization bypass when used with jwks-rsa...
Auth0 express-jwt Authorization Issues Vulnerability
Auth0 express-jwt is a package that supports authentication of JWT JSON Web tokens via the jsonwebtoken module from Auth0 USA. An authorization issue vulnerability exists in Auth0 express-jwt version 5.3.3 and earlier NPM package, which can be exploited by an attacker to bypass authorization with...
CVE-2020-15084
In express-jwt NPM package up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this...
Authorization
In express-jwt NPM package up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this...
CVE-2020-15084
CVE-2020-15084 affects express-jwt up to version 5.3.3, where the algorithms configuration is not enforced when using jwks-rsa as the secret, potentially allowing authorization bypass. The issue is resolved in version 6.0.0; remediation is to explicitly configure allowed algorithms (e.g., RS256) ...
CVE-2020-15084 Authorization bypass in express-jwt
In express-jwt NPM package up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this...
CVE-2020-15084
In express-jwt NPM package up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this...
Authorization bypass in express-jwt
Overview Versions before and including 5.3.3, we are not enforcing the algorithms entry to be specified in the configuration. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. Am I affected? You are affected by this...
GHSA-6G6M-M6H5-W9GF Authorization bypass in express-jwt
Overview Versions before and including 5.3.3, we are not enforcing the algorithms entry to be specified in the configuration. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. Am I affected? You are affected by this...