Lucene search
+L

217 matches found

Kitploit
Kitploit
added 2026/09/21 2:53 a.m.11 views

CVE-2025-65945-poc

CVE-2025-65945: node-jws Signature Bypass This is a proof of concept for a signature verification bypass in the node-jws library. The bug lets attackers forge valid JWTs when the server derives HMAC secrets from user-controlled data. What's the bug? The jws.createVerify function doesn't validate...

7.5CVSS5.9AI score0.00215EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/20 11:10 p.m.16 views

jwtear

Jwtear A modular command-line tool to parse, create and manipulate JSON Web TokenJWT tokens for security testing purposes. Features Complete modularity. All commands are plugins. Easy to add new plugins. Support JWS and JWE tokens. Easy interface for plugins. follow the template example Flexible...

6.1AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/20 9:28 p.m.9 views

POC-CVE-2018-0114

CVE-2018-0114 POC A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON...

7.5CVSS7.5AI score0.42651EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/18 9:27 p.m.7 views

CVE-2018-0114-Exploit

CVE-2018-0114-利用 在 0.11.0 之前的 Cisco node-jose 开源库中存在一个漏洞,可能允许未经身份验证的远程攻击者使用嵌入在令牌中的密钥重新签署令牌。该漏洞源于 node-jose 遵循 JSON Web 令牌(JWT)的 JSON Web 签名(JWS)标准。该标准规定,代表公钥的 JSON Web 密钥(JWK)可以嵌入到 JWS 的头部中。此公钥随后被信任用于验证。攻击者可以通过移除原始签名、向头部添加新的公钥,然后使用与嵌入在该 JWS 头部中的公钥相关联的(攻击者拥有的)私钥对对象进行签名,来伪造有效的 JWS 对象。...

7.5CVSS7.3AI score0.42651EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/14 6:35 p.m.11 views

POC-CVE-2018-0114

POC-CVE-2018-0114 该仓库包含针对 node-jose Stating from the last merge root@kitploit: python lib: base64,urllib,rsa,sys 运行测试 只需运行以下命令即可执行脚本: root@kitploit: python jwk-node-jose.py "payload" key-size key-size 不带大括号 作者 Andrea Cappa - 初始工作 - GitHub - Twitter Louis Nyffenegger - 支持与帮助 - Louis - 推荐; 许可...

7.5CVSS7.5AI score0.42651EPSS
SaveExploits6References2
Kitploit
Kitploit
added 2026/09/14 11:47 a.m.6 views

cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227 JWT Authentication Bypass Demo Project Goal This project demonstrates the CVE-2022-39227 vulnerability in a controlled local lab environment. This vulnerability affects the python-jwt library versions 3.3.4 and allows an attacker to forge JWT claims without knowing the secret key b...

9.1CVSS8.3AI score0.05386EPSS
SaveExploits2
SUSE CVE
SUSE CVE
added 2026/09/05 12:24 a.m.10 views

SUSE CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS5.7AI score0.00087EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/09/04 12:00 a.m.12 views

Linux Distros Unpatched Vulnerability : CVE-2026-84185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the...

5.9CVSS6.3AI score0.00087EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/03 9:17 p.m.7 views

DEBIAN-CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS5.4AI score0.00087EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/03 9:17 p.m.10 views

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS0.00087EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/03 9:17 p.m.7 views

UBUNTU-CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS5.7AI score0.00087EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/09/03 9:17 p.m.10 views

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS5.4AI score0.00087EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/09/03 8:46 p.m.11 views

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS5.7AI score0.00087EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/09/03 8:46 p.m.34 views

CVE-2026-84185 Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS0.00087EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/03 8:46 p.m.12 views

EUVD-2026-70747

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS5.8AI score0.00087EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/03 8:46 p.m.33 views

CVE-2026-84185

CVE-2026-84185 affects the jwcrypto library, a Python implementation of the JOSE (JSON Object Signing and Encryption) standards. The flaw occurs during verification of a General JSON Serialization JWS against a key set (JWKset): due to a coding error, the library fails to correctly match the key ...

5.9CVSS5.8AI score0.00087EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/09/03 8:46 p.m.10 views

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS5.4AI score0.00087EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/09/03 12:00 a.m.14 views

PT-2026-85251

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

5.9CVSS5.4AI score0.00087EPSS
SaveExploits0References10
NVD
NVD
added 2026/08/18 8:17 p.m.13 views

CVE-2026-70666

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

7.4CVSS0.00165EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/08/07 12:55 p.m.14 views

CVE-2026-50634

A flaw was found in Apache CXF. The JwsJsonContainerRequestFilter component can be exploited to process metadata that has not been authenticated by an accepted signature. This bypasses the application's security assumption that Content-Type or protected HTTP-header metadata originates from a...

6.5CVSS5.3AI score0.00267EPSS
SaveExploits0References5
Rows per page
Query Builder