Lucene search
+L

203 matches found

Kitploit
Kitploit
added 2026/08/26 6:09 a.m.3 views

POC-CVE-2018-0114

CVE-2018-0114 POC Cisco के node-jose ओपन सोर्स लाइब्रेरी के 0.11.0 से पहले के संस्करण में एक कमज़ोरी थी जो एक अप्रमाणित, दूरस्थ हमलावर को टोकन में एम्बेडेड कुंजी का उपयोग करके टोकन पर फिर से हस्ताक्षर करने की अनुमति दे सकती थी। यह कमज़ोरी node-jose द्वारा JSON वेब टोकन JWT के लिए JSON वेब सिग्नेच...

7.5CVSS7AI score0.42651EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/08/25 7:34 p.m.1 views

jwtear

Jwtear Uma ferramenta modular de linha de comando para analisar, criar e manipular tokens JSON Web Token JWT para fins de teste de segurança. Funcionalidades Modularidade completa. Todos os comandos são plugins. Fácil adicionar novos plugins. Suporte a tokens JWS e JWE. Interface fácil para...

5.2AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/08/25 8:56 a.m.2 views

CVE-2025-65945-poc

CVE-2025-65945: node-jws हस्ताक्षर बाईपास यह node-jws लाइब्रेरी में हस्ताक्षर सत्यापन बाईपास के लिए एक प्रूफ ऑफ कॉन्सेप्ट है। यह बग हमलावरों को वैध JWT बनाने की अनुमति देता है जब सर्वर उपयोगकर्ता-नियंत्रित डेटा से HMAC रहस्य प्राप्त करता है। बग क्या है? jws.createVerify फ़ंक्शन यह मान्य नहीं करता...

7.5CVSS5.2AI score0.00219EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/25 4:30 a.m.2 views

CVE-2018-0114-Exploit

CVE-2018-0114-Exploit Cisco node-jose ओपन सोर्स लाइब्रेरी 0.11.0 से पहले के संस्करण में एक कमजोरी एक अनप्रमाणित, दूरस्थ हमलावर को टोकन के भीतर एम्बेडेड कुंजी का उपयोग करके टोकन को फिर से हस्ताक्षरित करने की अनुमति दे सकती है। यह कमजोरी node-jose द्वारा JSON Web Signature JWS मानक का पालन करने के...

7.5CVSS7AI score0.42651EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/08/25 4:22 a.m.1 views

cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227 JWT Authentication Bypass Demo Цель проекта Этот проект демонстрирует уязвимость CVE-2022-39227 в контролируемой локальной лабораторной среде. Эта уязвимость затрагивает библиотеку python-jwt версии 3.3.4 и позволяет атакующему подделывать утверждения JWT claims без знания секретно...

9.1CVSS8.7AI score0.03977EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/24 6:34 p.m.2 views

POC-CVE-2018-0114

POC-CVE-2018-0114 यह रिपॉज़िटरी node-jose Stating from the last merge root@kitploit: python lib: base64,urllib,rsa,sys...

7.5CVSS0.42651EPSS
SaveExploits6
NVD
NVD
added 2026/08/18 8:17 p.m.5 views

CVE-2026-70666

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

7.4CVSS0.00165EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/08/07 12:55 p.m.10 views

CVE-2026-50634

A flaw was found in Apache CXF. The JwsJsonContainerRequestFilter component can be exploited to process metadata that has not been authenticated by an accepted signature. This bypasses the application's security assumption that Content-Type or protected HTTP-header metadata originates from a...

6.5CVSS5.3AI score0.00267EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/04 2:52 p.m.5 views

CLSA-2026-1784943208 TuxCare security update for jws (3 CVEs)

TuxCare rebuilt jws to address 3 CVEs. Fixed in 0.2.6-tuxcare.1...

7.5CVSS5.8AI score0.01798EPSS
SaveExploits2
RedHat Linux
RedHat Linux
added 2026/07/11 1:14 a.m.9 views

python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens

A flaw was found in PyJWT. A remote attacker can exploit this by supplying an arbitrarily large Base64URL payload segment when verifying detached JSON Web Signature JWS tokens using the unencoded-payload option. This forces excessive CPU work and memory allocations, leading to a Denial of Service...

5.3CVSS6AI score0.0037EPSS
SaveExploits1References5
EUVD
EUVD
added 2026/06/26 8:59 p.m.24 views

EUVD-2026-37805

joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization...

5.3CVSS5.8AI score0.00163EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/18 9:09 p.m.31 views

GHSA-JC38-X7X8-2XC8 PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

Summary JWSVerifier::getAlgorithm in src/Library/Signature/JWSVerifier.php line 144 merges protected and unprotected headers using PHP's spread operator: php $completeHeader = ...$signature-getProtectedHeader, ...$signature-getHeader; In PHP, when spreading arrays with duplicate string keys, the...

9.1CVSS5.5AI score
SaveExploits0References3
NVD
NVD
added 2026/06/17 10:16 p.m.21 views

CVE-2026-48990

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion...

5.3CVSS0.00163EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/17 10:16 p.m.17 views

DEBIAN-CVE-2026-48990

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion...

5.3CVSS5.4AI score0.00163EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/17 9:08 p.m.34 views

CVE-2026-48990 joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion...

5.3CVSS0.00163EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/17 12:00 a.m.26 views

PT-2026-50551

Name of the Vulnerable Software and Affected Versions joserfc versions 1.3.4 through 1.6.5 Description joserfc is a Python library implementing JSON Object Signing and Encryption JOSE standards. The library fails to apply the JWSRegistry.max payload length limit when processing RFC7797 b64=false...

5.3CVSS5.8AI score0.00163EPSS
SaveExploits0References19
EUVD
EUVD
added 2026/06/15 7:29 p.m.17 views

EUVD-2026-32919

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS...

5.3CVSS5.1AI score0.0037EPSS
SaveExploits1References3
Github Security Blog
Github Security Blog
added 2026/06/15 7:29 p.m.64 views

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

!NOTE Practical impact depends on whether request body-size limits are enforced upstream proxy/web-server/framework. Deployments with typical body-size caps ≤2 MB bound the amplifier significantly; deployments accepting larger token inputs are more exposed. When verifying detached JWS tokens usin...

5.3CVSS5.5AI score0.0037EPSS
SaveExploits1References4Affected Software1
NVD
NVD
added 2026/06/12 10:16 a.m.18 views

CVE-2026-50634

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted Content-Type or protected HTTP-header metadata came from a verified...

6.5CVSS0.00267EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/12 9:05 a.m.89 views

CVE-2026-50634

CVE-2026-50634 affects Apache CXF's JwsJsonContainerRequestFilter. The vulnerability allows CXF to process metadata that was not authenticated by the accepted signature, bypassing the assumption that Content-Type or protected HTTP-header metadata came from a verified signature. This can influence...

6.5CVSS5.3AI score0.00267EPSS
SaveExploits0References2Affected Software1
Rows per page
Query Builder