1869 matches found
ArgoCD 安全漏洞
ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...
Apache Apisix Information Disclosure Vulnerability
Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in microservices systems. versions prior to Apache Apisix 2.13.1 contain an information...
Apache Apisix 安全漏洞
Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in microservices systems. versions prior to Apache Apisix 2.13.1 contain an information...
PT-2022-16918 · Unknown · Postgresql +1
Name of the Vulnerable Software and Affected Versions: Gin-vue-admin versions prior to 2.5.1 Description: The issue occurs in the server/service/system/sys auto code pgsql.go code, which means PostgreSQL must be used as the database for this problem to occur. Users must have JWT login and be usin...
envoy: Null pointer dereference when using JWT filter safe_regex match
A flaw was found in envoy. A crafted request can potentially trigger a NULL pointer dereference when using a WT filter saferegex match...
CVE-2022-22332
IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131...
CVE-2022-22311
IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to improper validiation of JWT tokens...
IBM Security Verify Access 输入验证错误漏洞
IBM Security Verify Access ISAM is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT, and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls,...
CVE-2022-22332
IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131...
PT-2022-11913 · Envoy · Envoy
Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue affects Envoy, an open source edge and service proxy for cloud-native applications. A crafted request can crash Envoy when a CONNECT request is sent to the JWT filter configured wit...
Envoy 代码问题漏洞
Envoy is an open source distributed proxy server. Envoy suffers from a code issue vulnerability that stems from a crafted request crashing when a CONNECT request is sent to a JWT filter configured with regex matching in the affected version...
Zabbix - A Case Study of Unsafe Session Storage
Introduction Zabbix is a very popular open-source monitoring platform used to collect, centralize and track metrics like CPU load and network traffic across entire infrastructures. It is very similar to solutions like Pandora FMS and Nagios. Because of its popularity, features and its privileged...
CVE-2021-23207
An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ queues and messages by impersonating user...
Homer WebApp 信任管理问题漏洞
Homer WebApp is an open source Go Web application hosting the Homer-AppHep/Homer 7.7+ stack from Sipcapture in the Netherlands. A security vulnerability exists in Homer WebApp 7.x before 1.4.28, which stems from the QXIP SIPCAPTURE homer-app having the same 167f0db2-f83e-4baa-9736-d56064a5b415 JW...
CVE-2021-45389
A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864...
PT-2022-12338 · Starwind · Starwind Command Center +1
Name of the Vulnerable Software and Affected Versions: StarWind SAN and NAS build 1578 StarWind Command Center build 6864 Description: A flaw was found with the JWT token, allowing a self-signed JWT token to be injected into the update manager and bypass the authentication process, thus escalatin...
Fresenius Kabi Agilia Connect Infusion System 加密问题漏洞
The Fresenius Kabi Agilia Connect Infusion System is an infusion system from Fresenius Kabi, Germany. The Fresenius Kabi Agilia Connect Infusion System suffers from a cryptographic issue vulnerability that stems from the Vigilant MasterMed application issuing authentication tokens to authenticate...
GHSA-VPFP-5GWQ-G533 Improper Authentication in Apache ShenYu Admin
A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0...
CVE-2021-24804
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site...
