CVE-2025-30144

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a...

CVE-2025-30144 Fast-JWT Improperly Validates iss Claims

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a...

CVE-2025-30144

CVE-2025-30144 affects the fast-jwt library prior to 5.0.6, where iss validation incorrectly accepts an array of strings as a valid issuer. This permissive check can let an attacker forge a JWT containing an issuer array like [host, https://valid-iss], which may be accepted by verifiers (especial...

Incorrect Comparison

PyJWT is vulnerable to Incorrect Comparison. The vulnerability is due to improper handling of the iss claim check caused by the use of in for string comparison instead of strict equality, potentially allowing incorrect issuer values to pass validation...

UBUNTU-CVE-2024-53861

pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for "abc". This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. Since st...

Incorrect Comparison

Overview Affected versions of this package are vulnerable to Incorrect Comparison due to an incorrect string comparison in the iss verification process. Remediation Upgrade pyjwt to version 2.10.1 or higher. References - GitHub Commit - Vulnerable Code...

Incorrect Comparison

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Incorrect Comparison due to an incorrect string comparison in the iss verification process. Remediation Upgrade PyJWT to version 2.10.1 or higher. References - GitHub Commit - Vulnerable Cod...

PT-2024-35959

Name of the Vulnerable Software and Affected Versions: pyjwt versions 2.10.0 through 2.10.0 Description: An incorrect string comparison is run for iss checking, resulting in "acb" being accepted for " abc ". This is a bug introduced in version 2.10.0, where the "iss" claim checking changed from...

CVE-2024-5037 Openshift/telemeter: iss check during jwt authentication can be bypassed

A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue "iss" check during JSON web token JWT authentication...

CVE-2024-5037 Openshift/telemeter: iss check during jwt authentication can be bypassed

A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue "iss" check during JSON web token JWT authentication...

Malicious code in lambda-iss-location (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d7bd1b87c4b816789f583c6667d202f613eab5d352c1fcbe90fe1b182a0d13c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Security Directory Server is vulnerable to path traversal (CVE-2022-33164)

Summary A Security Vulnerability that affects the IBM Security Directory Server was addressed in the IBM Security Directory Integrator product. Vulnerability Details CVEID:CVE-2022-33164 DESCRIPTION: IBM Security Directory Server could allow a remote attacker to traverse directories on the system...

Security Bulletin: IBM Security Verify Governance, Identity Manager virtual appliance component vulnerable to spoofing attacks (CVE-2022-38712)

Summary IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerability. Vulnerability Details CVEID:CVE-2022-38712 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to...

Security Bulletin: Security vulnerabilities have been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component

Summary IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerabilities Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the BNmodsqrt function when parsing certificate...

IT security: An opportunity to raise corporate governance scores

What is a corporate governance score? Corporate governance scoring is increasingly important to boards of directors, executive leadership, and the investment community. If we want to enlist the support of a stakeholder, we have to talk about the things that are important to them. Sales revenue is...

Malicious code in iss-azure-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddb1ed4fc5691644616c46ab640b65a1795b01c150be473a82170f8a93e22caf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3973 Malicious code in iss-azure-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddb1ed4fc5691644616c46ab640b65a1795b01c150be473a82170f8a93e22caf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2003-5002

A vulnerability was found in ISS BlackICE PC Protection. It has been declared as problematic. Affected by this vulnerability is the component Update Handler which allows cleartext transmission of data. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2003-5003

A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is the Update Handler. The manipulation with an unknown input leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may ...

CVE-2003-5003 ISS BlackICE PC Protection Update cross site scriting

A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is the Update Handler. The manipulation with an unknown input leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may ...