CVE-2023-25653 Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

CVE-2023-25653

CVE-2023-25653 affects the node-jose library (JOSE for web browsers and Node.js) when using the non-default fallback crypto backend. The root cause is an infinite loop in ECC-related calculations due to how the modular inverse result from the jsbn library can be negative, which breaks the Barrett...

CVE-2023-25653 Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

jose 安全漏洞

npm jose is an application from the U.S. company npm. JWA, JWS, JWE, JWT, JWK using native encryption runtime without dependencies. A security vulnerability exists in versions prior to jose 2.2.0, which stems from the presence of a denial-of-service DoS vulnerability...

sanjoseweb.com.ar Cross Site Scripting vulnerability OBB-3175831

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-23928

reason-jose is a JOSE implementation in ReasonML and OCaml.Jose.Jws.validate does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass...

Authorization

reason-jose is a JOSE implementation in ReasonML and OCaml.Jose.Jws.validate does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass...

CVE-2023-23928 reason-jose ignores signature checks

reason-jose is a JOSE implementation in ReasonML and OCaml.Jose.Jws.validate does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass...

CVE-2023-23928 reason-jose ignores signature checks

reason-jose is a JOSE implementation in ReasonML and OCaml.Jose.Jws.validate does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass...

CVE-2023-23928

CVE-2023-23928 concerns reason-jose, a JOSE implementation in ReasonML/OCaml, where Jose.Jws.validate fails to verify HS256 signatures. This allows tampering of JWS headers/payloads when additional server-side checks are absent, potentially enabling authorization bypass or privilege escalation fo...

CVE-2023-23928 reason-jose ignores signature checks

reason-jose is a JOSE implementation in ReasonML and OCaml.Jose.Jws.validate does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass...

PT-2023-19302 · Unknown · Reason-Jose

Name of the Vulnerable Software and Affected Versions: reason-jose versions prior to 0.8.2 Description: The issue affects the Jose.Jws.validate function, which does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks,...

WordPress Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin <= 1.9.4.0 is vulnerable to Sensitive Data Exposure

Software Freesoul Deactivate Plugins – Plugin manager and cleanup Type Plugin Vulnerable versions = 1.9.4.0 Fixed in 1.9.4.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-22687 Patch priority Low CVSS severity Low 3.7 Developer Jose Mortellaro PSID...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Apache Commons is used by IBM Robotic Process Automation as part of the Watson NLP functionality CVE-2022-42889. Connect2id Nimbus JOSE+JWT is used by IBM Robotic Process Automation as part of the...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to CVE-2022-36083

Summary Node.js module jose is used by IBM App Connect Enterprise Certified Container for securing internal communications and in connections by connectors to SaaS endpoints. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service. This bulletin provides pat...

Wallarm at API World and KubeCon 2022 this week

This is a busy week for the whole Wallarm team as we are sponsoring two big conferences at the very same time. API World 2022 Wallarm will be at API World in San Jose starting today. Stop by booth 209 to chat with our apisecurity experts about everything APIs, and check out a demo of Wallarm WAAP...

Security Bulletin: Vulnerability in the Node.js jose module affects IBM Event Streams (CVE-2022-36083)

Summary This security vulnerability affects the Node.js jose module that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-36083 DESCRIPTION: Node.js jose module is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted request usin...

@teachbase/utils (1.0.1) potentially affected by CVE-2022-36083 via jose-browser-runtime (3.16.1)

jose-browser-runtime NPM version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on jose-browser-runtime and may be impacted: - @teachbase/utils 1.0.1 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

@dci-lint/cmd-api-server (>=0.3.0, <=0.4.0), @dci-lint/test-api-client (>=0.3.0, <=0.4.0) +46 more potentially affected by CVE-2022-36083 via jose (>=1.18.1, <=1.28.1)

jose NPM version =1.18.1, =0.3.0, =0.3.0, =0.3.0, =0.10.0-unstable.0042dcd, =0.6.1, =0.6.3, =0.6.3, =0.6.4, =0.6.3, =0.6.9, =0.6.1, =0.6.3, =0.6.3, =0.6.3, =0.6.5, =0.9.4 and more Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

cortex-cli (>=2.0.8, <=2.1.0) potentially affected by CVE-2022-36083 via jose-node-cjs-runtime (>=4.6.0, <=4.8.1)

jose-node-cjs-runtime NPM version =4.6.0, =2.0.8, =2.1.0 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...