POC-CVE-2018-0114

CVE-2018-0114 POC Una vulnerabilidad en la librería de código abierto node-jose de Cisco, anterior a la versión 0.11.0, podría permitir a un atacante remoto no autenticado volver a firmar tokens utilizando una clave incrustada dentro del propio token. La vulnerabilidad se debe a que node-jose sig...

CVE-2018-0114

CVE-2018-0114 Cisco の node-jose（JWT を管理するために作成された JavaScript ライブラリ）の脆弱性の悪用。 Cisco の node-jose のこの脆弱性により、攻撃者は悪意のあるトークンを偽造できます。 JWT では、ユーザーはトークンのヘッダー内に公開鍵（jwk 値を使用）を埋め込むことができます。ただし、アプリケーションはそれらの鍵を決して信頼すべきではありません。攻撃者は自身の鍵を提供し、対応する秘密鍵を使用してメッセージに署名できるからです。 レビュー この問題はバージョン 0.11 より前のバージョンに影響します。...

POC-CVE-2018-0114

POC-CVE-2018-0114 该仓库包含针对 node-jose Stating from the last merge root@kitploit: python lib: base64,urllib,rsa,sys 运行测试 只需运行以下命令即可执行脚本： root@kitploit: python jwk-node-jose.py "payload" key-size key-size 不带大括号 作者 Andrea Cappa - 初始工作 - GitHub - Twitter Louis Nyffenegger - 支持与帮助 - Louis - 推荐； 许可...

CVE-2018-0114

CVE-2018-0114 用于JWT生成的python2.7脚本 CVE-2018-0114 A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web...

CVE-2018-0114

CVE-2018-0114 Exploit para Node-jose 0.11.0 escrito en Ruby Uso solo ingresa el nombre de la víctima en el código y ejecuta el archivo con ruby ./exploit.rb Una vulnerabilidad en la librería de código abierto node-jose de Cisco anterior a la versión 0.11.0 podría permitir que un atacante remoto n...

CVE-2018-0114-Exploit

CVE-2018-0114-利用 在 0.11.0 之前的 Cisco node-jose 开源库中存在一个漏洞，可能允许未经身份验证的远程攻击者使用嵌入在令牌中的密钥重新签署令牌。该漏洞源于 node-jose 遵循 JSON Web 令牌（JWT）的 JSON Web 签名（JWS）标准。该标准规定，代表公钥的 JSON Web 密钥（JWK）可以嵌入到 JWS 的头部中。此公钥随后被信任用于验证。攻击者可以通过移除原始签名、向头部添加新的公钥，然后使用与嵌入在该 JWS 头部中的公钥相关联的（攻击者拥有的）私钥对对象进行签名，来伪造有效的 JWS 对象。...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33895 via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33895 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789768...

CVE-2023-25653

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

EUVD-2018-0319

Malware in sbrugna...

EUVD-2023-0629

Malicious code in bioql PyPI...

Security Bulletin: Cisco node-jose is vulnerable to CVE-2023-25653 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses Cisco node-jose which is vulnerable to CVE-2023-25653. Vulnerability Details CVEID:CVE-2023-25653 DESCRIPTION: Cisco node-jose is vulnerable to a denial of service, caused by improper calculations in ECC implementation. By sending a...

Denial Of Service (DoS)

node-jose is vulnerable to Denial Of Service DoS. The vulnerability exists due to an infinite loop in the internal calculation for some ECC operations when using the library's non-default "fallback" crypto back-end, when either WebCrypto or the crypto module is unavailable, which allows an attack...

CVE-2023-25653

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

GHSA-5H4J-QRVG-9XHW Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

Description When using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered ...

7ghost (>=4.11.0, <=4.11.46), @credify/credify-js (>=1.8.0, <=1.16.7) +33 more potentially affected by CVE-2023-25653 via node-jose (>=2.0.0, <=2.1.1)

node-jose NPM version =2.0.0, =4.11.0, =1.8.0, =1.4.6, =0.6.1, =0.1.11, =2.0.0, =0.0.0-experimental-1bf6ab9, =0.1.4, =3.41.6, =1.1.68, =1.0.0, =0.4.0, =0.7.7 and more Source cves: CVE-2023-25653 Source advisory: OSV:GHSA-5H4J-QRVG-9XHW...

CVE-2023-25653 Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

CVE-2023-25653

CVE-2023-25653 affects the node-jose library (JOSE for web browsers and Node.js) when using the non-default fallback crypto backend. The root cause is an infinite loop in ECC-related calculations due to how the modular inverse result from the jsbn library can be negative, which breaks the Barrett...

CVE-2023-25653 Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

@ciscospark/internal-plugin-board (>=1.0.0, <=1.28.2), @ciscospark/internal-plugin-calendar (>=1.0.0, <=1.28.2) +37 more potentially affected by CVE-2018-0114 via node-jose (>=0.9.4, <=0.10.0)

node-jose NPM version =0.9.4, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.7.0, =0.7.92, =0.7.0, =0.7.71, =0.7.0, =0.7.0, =0.7.0, =0.1.137, =0.1.207 and more Source cves: CVE-2018-0114 Source advisory: OSV:GHSA-JFXM-W8G2-4RCV...

GHSA-JFXM-W8G2-4RCV Cisco node-jose improper validation of JWT signature

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...