CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret...

CVE-2019-20933

InfluxDB before 1.7.6 contains an authentication bypass in the authenticate function (services/httpd/handler.go) where a JWT token may carry an empty SharedSecret. This can allow an attacker to bypass authentication and gain unauthorized access, potentially enabling data modification or administr...

InfluxDB authentication bypass vulnerability

InfluxDB is an open source temporal database developed by InfluxData. An authentication bypass vulnerability exists in the authenticate function in services/httpd/handler.go in versions prior to InfluxDB 1.7.6. The vulnerability stems from the fact that JWT tokens may have an empty SharedSecret. ...

Denial Of Service (DoS)

github.com/nats-io/nats-server is vulnerable to denial of service DoS. An attacker can cause an application to crash by sending a malicious JWT...

CVE-2020-26892

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

CVE-2020-26521

The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...

Code injection

The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...

Code injection

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

CVE-2020-26521

The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...

UBUNTU-CVE-2020-26892

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

CVE-2020-26892

Summary : CVE-2020-26892 affects NATS nats-server before 2.1.9 due to incorrect access control from how expired credentials are handled in the JWT library. The vulnerability stems from the JWT package’s credential expiry checks, which could allow bypassing access restrictions. Affected versions i...

CVE-2020-26892

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

CVE-2020-26892

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

CVE-2020-26521

CVE-2020-26521 affects NATS server’s JWT handling: the JWT library (used by nats-server) can dereference nil during decoding, causing Denial of Service. Affected: NATS Server versions before 2.1.9. Root cause: nil dereference in Go code when processing User JWTs. Remediation: upgrade the JWT depe...

CVE-2020-26521

The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...

CVE-2020-26521

The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...

PT-2020-16534

Name of the Vulnerable Software and Affected Versions NATS nats-server versions 2.0.0 through 2.1.8 JWT library versions prior to 1.1.0 Description The issue is related to Incorrect Access Control in the JWT library used by NATS nats-server, specifically in how expired credentials are handled. Th...

CVE-2020-26892: Use of Hard-coded Credentials

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled...

CVE-2020-26521: NULL Pointer Dereference

The JWT library in NATS nats-server before 2.1.9 allows a denial of service a nil dereference in Go code...

PT-2020-16435

Name of the Vulnerable Software and Affected Versions NATS Server versions 2 prior to 2.1.9 JWT library versions prior to 1.1.0 Description A malicious account can create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library would attempt a...