558 matches found
CVE-2023-31580
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...
CVE-2023-31580
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...
Design/Logic Flaw
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...
CVE-2023-31580
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...
CVE-2023-31580
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...
PT-2023-23396
Name of the Vulnerable Software and Affected Versions light-oauth2 versions prior to 2.1.27 Description The issue allows attackers to authenticate to the application with a crafted JWT token because the public key is obtained without verification. Recommendations For versions prior to 2.1.27,...
CVE-2023-31580
CVE-2023-31580 affects light-oauth2 (before version 2.1.27). The root cause is that the library obtains the public key without verification, enabling a crafted JWT to authenticate to the application. Impact is authentication bypass for systems relying on this key verification. Remediation per ava...
CVE-2023-31580: Improper Certificate Validation
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...
Authentication Bypass
neuvector is vulnerable to Authentication Bypass. An attacker can reverse engineer a JWT token, forging a valid taken to perform malicious activity. This can lead to RCE...
GHSA-622H-H2P8-743X JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
Impact A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. Patches Upgrade to NeuVector version 5.2.2 or later and latest Helm chart 2.6.3+....
CVE-2023-43652
JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used ...
CVE-2023-5074 Authentication Bypass in D-Link D-View 8
Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28...
CVE-2023-5074 Authentication Bypass in D-Link D-View 8
Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28...
CVE-2023-5074
CVE-2023-5074 affects D-Link D-View 8, specifically version 2.0.1.28, where a static key protects the JWT used for user authentication. This design enables an authentication bypass risk by forging or manipulating tokens, effectively allowing unauthorized access to D-View 8 systems. The relevant c...
CVE-2023-5074: Use of Hard-coded Credentials
Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28...
PT-2023-5389 · D Link · D-Link D-View 8
Name of the Vulnerable Software and Affected Versions: D-Link D-View 8 version 2.0.1.28 Description: The issue is related to the use of a static key for protecting JWT tokens in user authentication, which can allow an attacker to bypass security restrictions and gain unauthorized access to...
CVE-2023-39846
An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...
CVE-2023-39846: Improper Authentication
An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...
