31 matches found
CVE-2020-37281
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2020-37281
Gravitee API Management versions through 4.12.22 are vulnerable to an authentication bypass caused by the use of a default JWT secret (CWE-1394). An unauthenticated remote attacker who knows an existing user ID can forge an HS256 token signed with the shipped default secret. By presenting this fo...
EUVD-2020-31280
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2020-37281
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
PT-2026-113755
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
CVE-2020-37281: Use of Default Cryptographic Key
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...
EUVD-2022-6644
Malicious code in bioql PyPI...
EUVD-2023-0563
Malicious code in bioql PyPI...
GHSA-VP62-M958-QJ8C Gravitee API Management contains Path Traversal
This CVE addresses the partial fix for CVE-2019-25075 Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary...
Gravitee API Management contains Path Traversal
This CVE addresses the partial fix for CVE-2019-25075 Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary...
CVE-2022-38723
Gravitee API Management before 3.15.13 allows path traversal through HTML injection...
Path traversal
Gravitee API Management before 3.15.13 allows path traversal through HTML injection...
CVE-2022-38723
Gravitee API Management before 3.15.13 allows path traversal through HTML injection...
CVE-2022-38723
CVE-2022-38723 affects Gravitee API Management prior to version 3.15.13, where an HTML-injection flaw enables path traversal. Multiple connected sources confirm the vulnerability exists in Gravitee API Management before 3.15.13 and describe the underlying issue as HTML injection that allows path ...
PT-2023-13640 · Unknown · Gravitee Api Management
Name of the Vulnerable Software and Affected Versions: Gravitee API Management versions prior to 3.15.13 Description: The issue allows path traversal through HTML injection, potentially enabling anonymous users to read arbitrary files. This is achieved by combining HTML injection with path...
CVE-2022-38723: Improper Limitation of a Pathname to a Restricted Directory
Gravitee API Management before 3.15.13 allows path traversal through HTML injection...