3617 matches found
CVE-2022-44796
CVE-2022-44796 concerns Object First Ootbi BETA. Affected versions: 1.0.7.712 (and up to 1.0.13.1610 per PT-2022-27316) with an authorization flow that allows access to the Web UI without credentials. The root cause is a JWT signing key generated by a function that does not produce cryptographica...
CVE-2022-44796
An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function that doesn't produce cryptographically...
CVE-2022-44796
An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function that doesn't produce cryptographically...
Linktree: Account takeover - improper validation of jwt signature (with regards to experiation date claim)
Some backend services did not properly validate JWTs. As a result JWT validation could be bypassed by setting the expiration date claim to a unix timestamp in the past, and abusing this for account takeover. The expiration date claim of the JWT token was not properly handled. I was able to bypass...
GHSA-R8GM-V65F-C973 acryl-datahub missing JWT signature check
Missing JWT signature check GHSL-2022-078 The StatelessTokenService of the DataHub metadata service GMS does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because...
acryl-datahub missing JWT signature check
Missing JWT signature check GHSL-2022-078 The StatelessTokenService of the DataHub metadata service GMS does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because...
CVE-2022-39366
DataHub is an open-source metadata platform. Prior to version 0.8.45, the StatelessTokenService of the DataHub metadata service GMS does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This...
Authentication flaw
DataHub is an open-source metadata platform. Prior to version 0.8.45, the StatelessTokenService of the DataHub metadata service GMS does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This...
CVE-2022-39366 DataHub missing JWT signature check
DataHub is an open-source metadata platform. Prior to version 0.8.45, the StatelessTokenService of the DataHub metadata service GMS does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This...
CVE-2022-39366
DataHub (GMS) prior to 0.8.45 uses StatelessTokenService that calls JwtParser.parse without cryptographic signature verification, enabling potential authentication bypass by accepting JWTs regardless of signature. A patch exists in 0.8.45; no public workarounds are noted. Affected component: Data...
CVE-2022-39366 DataHub missing JWT signature check
DataHub is an open-source metadata platform. Prior to version 0.8.45, the StatelessTokenService of the DataHub metadata service GMS does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This...
PT-2022-24933
Name of the Vulnerable Software and Affected Versions DataHub versions prior to 0.8.45 Description The StatelessTokenService of the DataHub metadata service does not verify the signature of JWT tokens, allowing an attacker to connect to DataHub instances as any user if Metadata Service...
MAL-2022-459 Malicious code in @nexthink/arm-jwt-decoder (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51df48a51ecff12b69c9a30fb95f37dcd19cbf557c11e050fb5cd202e6a1d8be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @nexthink/arm-jwt-decoder (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51df48a51ecff12b69c9a30fb95f37dcd19cbf557c11e050fb5cd202e6a1d8be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-39227 affecting package python-jwt for versions less than 2.4.0-2
CVE-2022-39227 affecting package python-jwt for versions less than 2.4.0-2. A patched version of the package is available...
CVE-2022-42980
go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...
CVE-2022-42983
anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens...
CVE-2022-42983
anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens...