2016 matches found
PYSEC-2024-191
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes when specified...
PYSEC-2024-191
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes when specified...
AWS ALB Route Directive Adapter For Istio 安全漏洞
AWS ALB Route Directive Adapter For Istio is an AWS ALB Route Directive Adapter for Istio open source by Amazon Web Services. A security vulnerability exists in AWS ALB Route Directive Adapter For Istio v1.0 and v1.1 that stems from the use of a JWT for authentication that lacks proper signer and...
Amazon.ApplicationLoadBalancer.Identity.AspNetCore 安全漏洞
Amazon.ApplicationLoadBalancer.Identity.AspNetCore is an open source load balancer for Amazon Web Services. A security vulnerability exists in Amazon.ApplicationLoadBalancer.Identity.AspNetCore that stems from an inability to verify the identity of the JWT issuer and signer in the JWT processing...
PT-2024-16047
Name of the Vulnerable Software and Affected Versions Amazon.ApplicationLoadBalancer.Identity.AspNetCore affected versions not specified Description The issue concerns the Amazon.ApplicationLoadBalancer.Identity.AspNetCore repository, which contains middleware for use with the Application Load...
CVE-2023-32188
A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...
NeuVector 安全漏洞
NeuVector is an end-to-end container security platform from US-based NeuVector. The platform includes features such as image vulnerability management, access control and container process/filesystem protection. A security vulnerability exists in previous versions of NeuVector...
SonarSource SonarQube 安全漏洞
SonarSource SonarQube is an open source code quality management system from SonarSource, Switzerland. A security vulnerability exists in SonarSource SonarQube versions prior to 9.9.5 LTA and 10.x versions prior to 10.5, which stems from the ability of a user with the administrator role to modify...
PT-2024-32675 · Pomerium +1 · Pomerium +1
Name of the Vulnerable Software and Affected Versions: Pomerium versions prior to 0.27.1 Description: Pomerium is an identity and context-aware access proxy. The Pomerium databroker service manages all persistent Pomerium application state. Requests to the databroker service API are authorized by...
CVE-2024-46612
IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information...
IceCMS 安全漏洞
IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . An authentication bypass vulnerability exists in IceCMS v3.4.7 and earlier versions, which stems from the inclusion of hard-coded JWT keys that can be exploited by an attacker to forge JWT...
PT-2024-32076 · Icecms · Icecms
Name of the Vulnerable Software and Affected Versions: IceCMS versions 3.4.7 and earlier Description: The issue allows an attacker to forge JWT authentication information due to a hardcoded JWT key. Recommendations: For IceCMS versions 3.4.7 and earlier, update to a version that does not contain...
CVE-2024-6786
The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT signing secrets...
Dragonfly 安全漏洞
Dragonfly is a framework that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly prior to version 2.0.9 that stems from Dragonfly's use of hard-coded JWT to authenticate users, which could lead to authentication bypass...
PT-2024-12138 · Dragonfly · Dragonfly
Name of the Vulnerable Software and Affected Versions: Dragonfly versions prior to 2.0.9 Description: The issue concerns Dragonfly, an open-source P2P-based file distribution and image acceleration system. It uses JWT to verify users, but the secret key for JWT is hardcoded, leading to...
Envoy 缓冲区错误漏洞
Envoy is an Enphase open source gateway program for connecting smart home devices. A buffer error vulnerability exists in versions prior to Envoy 1.29, which stems from a Jwt filter that causes Envoy to crash when clearing the routing cache using a remote JWK...
PT-2024-38749 · Unknown · Demozx Gf Cms
Name of the Vulnerable Software and Affected Versions: demozx gf cms versions 1.0 through 1.0.1 Description: A critical issue has been found in the JWT Authentication component, specifically affecting the init function of the file internal/logic/auth/auth.go. This allows for the manipulation of...
pREST vulnerable to jwt bypass + sql injection
Summary Probably jwt bypass + sql injection or what i'm doing wrong? PoC how to reproduce 1. Create following files: docker-compose.yml: services: postgres: image: postgres containername: postgrescontainermre environment: POSTGRESUSER: testuserpg POSTGRESPASSWORD: testpasspg POSTGRESDB: testdb...
PT-2024-26898 · Kubepi · Kubepi
Name of the Vulnerable Software and Affected Versions: KubePi versions 1.6.3 through 1.7.x Description: The issue is related to a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string is generated to overwrite the key...
1Panel KubePi 安全漏洞
1Panel KubePi is a K8s panel from the Chinese company 1Panel. It allows administrators to import multiple Kubernetes clusters and assign permissions for different clusters, namespaces to specified users through permission control. A security vulnerability exists in 1Panel KubePi version 1.6.3 up ...