CVE-2018-0114-Exploit

CVE-2018-0114-Exploit Una vulnerabilità nella libreria open source node-jose di Cisco, precedente alla versione 0.11.0, potrebbe consentire a un attaccante remoto non autenticato di ri-firmare token utilizzando una chiave incorporata nel token. La vulnerabilità è dovuta al fatto che node-jose seg...

CVE-2018-0114

CVE-2018-0114 script python2.7 para geração de JWT CVE-2018-0114 Uma vulnerabilidade na biblioteca open source Cisco node-jose anterior à versão 0.11.0 poderia permitir que um atacante remoto não autenticado reassinasse tokens usando uma chave incorporada no token. A vulnerabilidade se deve ao...

POC-CVE-2018-0114

CVE-2018-0114 POC Una vulnerabilità nella libreria open source Cisco node-jose precedente alla versione 0.11.0 potrebbe consentire a un attaccante remoto non autenticato di firmare nuovamente i token utilizzando una chiave incorporata nel token. La vulnerabilità è dovuta al fatto che node-jose...

CVE-2018-0114

CVE-2018-0114 Exploit für Node-jose 0.11.0 geschrieben in Ruby Verwendung Geben Sie einfach den Namen des Opfers in den Code ein und führen Sie die Datei mit ruby ./exploit.rb aus. Eine Sicherheitslücke in der Open-Source-Bibliothek Cisco node-jose vor Version 0.11.0 könnte es einem nicht...

CVE-2018-0114

CVE-2018-0114 Sfruttamento di una vulnerabilità nel node-jose di Cisco, una libreria JavaScript creata per gestire i JWT. Questa vulnerabilità nel node-jose di Cisco consente a un attaccante di falsificare token malevoli. JWT consente agli utenti di incorporare chiavi pubbliche usando il valore j...

POC-CVE-2018-0114

POC-CVE-2018-0114 Dieses Repository enthält den POC eines Exploits für node-jose Stating from the last merge root@kitploit:...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33895 via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33895 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789768...

CVE-2023-25653

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

EUVD-2018-0319

Malware in sbrugna...

EUVD-2023-0629

Malicious code in bioql PyPI...

Security Bulletin: Cisco node-jose is vulnerable to CVE-2023-25653 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses Cisco node-jose which is vulnerable to CVE-2023-25653. Vulnerability Details CVEID:CVE-2023-25653 DESCRIPTION: Cisco node-jose is vulnerable to a denial of service, caused by improper calculations in ECC implementation. By sending a...

Denial Of Service (DoS)

node-jose is vulnerable to Denial Of Service DoS. The vulnerability exists due to an infinite loop in the internal calculation for some ECC operations when using the library's non-default "fallback" crypto back-end, when either WebCrypto or the crypto module is unavailable, which allows an attack...

CVE-2023-25653

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

GHSA-5H4J-QRVG-9XHW Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

Description When using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered ...

7ghost (>=4.11.0, <=4.11.46), @credify/credify-js (>=1.8.0, <=1.16.7) +33 more potentially affected by CVE-2023-25653 via node-jose (>=2.0.0, <=2.1.1)

node-jose NPM version =2.0.0, =4.11.0, =1.8.0, =1.4.6, =0.6.1, =0.1.11, =2.0.0, =0.0.0-experimental-1bf6ab9, =0.1.4, =3.41.6, =1.1.68, =1.0.0, =0.4.0, =0.7.7 and more Source cves: CVE-2023-25653 Source advisory: OSV:GHSA-5H4J-QRVG-9XHW...

CVE-2023-25653 Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

CVE-2023-25653

CVE-2023-25653 affects the node-jose library (JOSE for web browsers and Node.js) when using the non-default fallback crypto backend. The root cause is an infinite loop in ECC-related calculations due to how the modular inverse result from the jsbn library can be negative, which breaks the Barrett...

CVE-2023-25653 Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

@ciscospark/internal-plugin-board (>=1.0.0, <=1.28.2), @ciscospark/internal-plugin-calendar (>=1.0.0, <=1.28.2) +37 more potentially affected by CVE-2018-0114 via node-jose (>=0.9.4, <=0.10.0)

node-jose NPM version =0.9.4, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.7.0, =0.7.92, =0.7.0, =0.7.71, =0.7.0, =0.7.0, =0.7.0, =0.1.137, =0.1.207 and more Source cves: CVE-2018-0114 Source advisory: OSV:GHSA-JFXM-W8G2-4RCV...

Cisco node-jose improper validation of JWT signature

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...