Jwtear - Modular Command-Line Tool To Parse, Create And Manipulate JWT Tokens For Hackers

A modular command-line tool to parse, create and manipulate JSON Web TokenJWT tokens for security testing purposes. Features Complete modularity. All commands are plugins. Easy to add new plugins. Support JWS and JWE tokens. Easy interface for plugins. follow the template example Flexible token...

Insecure Signature Verification

jsrsasign is vulnerable to insecure signature verification. The vulnerability exists because the library does not properly validate the JWS or JWT signature with non-Base64URL encoding special characters or number escaped characters such as !@$% or \11...

JWS and JWT signature validation vulnerability with special characters

Impact Jsrsasign supports JWSJSON Web Signatures and JWTJSON Web Token validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. For example, even if a string of non Base64URL encoding characters such...

GHSA-XM5F-HC9R-76F3 PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm

The PHP JOSE Library by Gree Inc. prior to 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens...

PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm

The PHP JOSE Library by Gree Inc. prior to 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens...

GHSA-JFXM-W8G2-4RCV Cisco node-jose improper validation of JWT signature

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

Cisco node-jose improper validation of JWT signature

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

CVE-2021-32631

Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authenticati...

CVE-2021-3003

Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle attackers to spoof product updates...

CVE-2016-8735

The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker...

[SECURITY] Fedora 32 Update: python-authlib-0.14.3-1.fc32

Python library for building OAuth and OpenID Connect servers. JWS, JWK, JWA, JWT are included...

Fedora: Security Advisory for python-authlib (FEDORA-2020-b90dac7fc4)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

GHSA-GJCW-V447-2W7Q Forgeable Public/Private Tokens in jws

Affected versions of the jws package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer token, the...

@irjudson/nitrogen-mongodb-providers (=0.3.7), @oada/oada-id-client (=1.0.0) +210 more potentially affected by CVE-2016-1000223 via jws (>=0.0.2 <=2.0.0)

jws NPM version =0.0.2, =0.1.11, =1.0.0, =0.0.2, =0.1.0, =0.0.7, =0.0.4, =1.0.0, =1.0.0, =1.0.8 - auth0-rule-sandbox =1.0.0 and more Source cves: CVE-2016-1000223 Source advisory: OSV:GHSA-GJCW-V447-2W7Q...

PT-2020-7931

Name of the Vulnerable Software and Affected Versions: jws versions prior to 3.0.0 Description: The issue allows a malicious actor to modify the contents of a JWT while still passing verification, potentially leading to a complete authentication bypass. This can be achieved by exploiting the...

CVE-2016-5431

The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens...

CVE-2016-5431

The CVE concerns the PHP JOSE Library by Gree Inc. prior to version 2.2.1. The underlying issue is key confusion/algorithm substitution in the JWS component, which allows bypassing signature verification with crafted tokens. Affected software/version: PHP JOSE Library

keycloak-core vulnerable to timing attacks against JWS token verification

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks...

GHSA-W6GV-3R3V-GWGJ keycloak-core vulnerable to timing attacks against JWS token verification

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks...

CVE-2017-2585

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks...