2371 matches found
CVE-2025-53960 Apache StreamPark: Uses the user’s password as the secret key
When issuing JSON Web Tokens JWT, Apache StreamPark directly uses the user's password as the HMAC signing key e.g., with the HS256 algorithm. An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge...
CVE-2025-53960: Use of a Cryptographic Primitive with a Risky Implementation
When issuing JSON Web Tokens JWT, Apache StreamPark directly uses the user's password as the HMAC signing key e.g., with the HS256 algorithm. An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge...
Network-Vuln
🔍 Network Vulnerability Scanner !Pythonhttps://img.shiel...
EUVD-2013-7289
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks...
DEBIAN-CVE-2013-10031
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks...
CVE-2013-10031
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks...
UBUNTU-CVE-2013-10031
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks...
CVE-2013-10031 Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks...
CVE-2013-10031 Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks...
CVE-2013-10031
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks...
Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2025-1312)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1312 advisory. HMAC verification check: fix incorrect memcmp call NOTE: https://community.openvpn.net/Security%20Announcements/CVE-2025-13086 CVE-2025-13086 Tenable has extracted the preceding description block...
Plack::Middleware::Session 安全漏洞
Plack::Middleware::Session is a Plack open source minimalist session library for Plack. A security vulnerability exists in Plack::Middleware::Session versions prior to 0.17, which stems from vulnerability to HMAC comparison timing attacks...
CVE-2013-10031: Incorrect Comparison Logic Granularity
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks...
Important: openvpn
Issue Overview: HMAC verification check: fix incorrect memcmp call NOTE: https://community.openvpn.net/Security%20Announcements/CVE-2025-13086 CVE-2025-13086 Affected Packages: openvpn Issue Correction: Run dnf update openvpn --releasever 2023.9.20251208 or dnf update --advisory ALAS2023-2025-131...
CVE-2025-65945
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the...
CVE-2025-65945
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the...
CVE-2025-65945
CVE-2025-65945 affects auth0/node-jws (Node.js). In affected versions (3.2.2 and earlier; 4.0.0) there is an improper HS256 signature verification under specific conditions when using jws.createVerify() with user-provided header/payload data in HMAC secret lookups. IBM bulletins corroborate the i...
CVE-2025-65945 auth0/node-jws improper HMAC signature verification vulnerability
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the...
Improper Verification of Cryptographic Signature
Overview jws is an Implementation of JSON Web Signatures Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the createVerify function when using HS256 HMAC algorithms and incorporating user-provided data from the JSON Web Signature Protected...