3647 matches found
Malicious code in lithosphere-eris-jwt-apollo (npm)
The package lithosphere-eris-jwt-apollo was found to contain malicious code...
MAL-2025-45542 Malicious code in perseus-postgres-jwt-config (npm)
The package perseus-postgres-jwt-config was found to contain malicious code...
MAL-2025-45495 Malicious code in outercore-oberon-library-jwt (npm)
The package outercore-oberon-library-jwt was found to contain malicious code...
CVE-2025-55739
api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...
CVE-2025-55739 api: Shared OAuth Signing Key Between Different Instances
api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).
...
Linux Distros Unpatched Vulnerability : CVE-2023-51774
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes...
Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by an Uncontrolled Recursion Vulnerability in Connect2id Nimbus JOSE + JWT (CVE-2025-53864)
Summary Connect2id Nimbus JOSE + JWT is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of integrating with OpenID Connect providers OIDC and is affected by an Uncontrolled Recursion Vulnerability. CVE-2025-53864. Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id...
Security Bulletin: Due to use of Connect2id Nimbus JOSE+JWT, IBM Watson Studio in Cloud Pak for Data is affected by denial of service
Summary Connect2id Nimbus JOSE+JWT is used by Watson Studio in Cloud Pak for Data. Vulnerability Details CVEID:CVE-2023-52428 DESCRIPTION: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration cou...
CVE-2025-4644
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token JWT, and then delete the account, which did not invalidate the JWT. As a result, the next newly created us...
CVE-2025-41702
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key...
Linux Distros Unpatched Vulnerability : CVE-2021-22190
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token CVE-2021-22190 Note that Nessus...
Linux Distros Unpatched Vulnerability : CVE-2019-18848
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. CVE-2019-18848 Note that Nessus relies on the presence of t...
MAL-2025-24138 Malicious code in jwt-toml-leda-despina (npm)
The package jwt-toml-leda-despina was found to contain malicious code...
Malicious code in jwt-technocracy-envconfig-venus (npm)
The package jwt-technocracy-envconfig-venus was found to contain malicious code...
MAL-2025-34579 Malicious code in taurus-transport-jwt-rimraf (npm)
The package taurus-transport-jwt-rimraf was found to contain malicious code...
MAL-2025-33417 Malicious code in slides-request-jwt-draco (npm)
The package slides-request-jwt-draco was found to contain malicious code...
MAL-2025-29142 Malicious code in phoebe-relay-jwt-pino (npm)
The package phoebe-relay-jwt-pino was found to contain malicious code...