CVE-2023-50658

The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...

CVE-2023-51775

The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...

Code injection

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration count for the PasswordBasedDecrypter PBKDF2 component...

CVE-2023-52428: Allocation of Resources Without Limits or Throttling

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration count for the PasswordBasedDecrypter PBKDF2 component...

CVE-2023-52428

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration count for the PasswordBasedDecrypter PBKDF2 component...

CVE-2023-50658: Allocation of Resources Without Limits or Throttling

The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...

CVE-2023-51775: Uncontrolled Resource Consumption

The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...

CVE-2023-49290: Uncontrolled Resource Consumption

lestrrat-go/jwx is a Go module implementing various JWx JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE technologies. A p2c parameter set too high in JWE's algorithm PBES2- could lead to a denial of service. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c...

PT-2023-8747

Name of the Vulnerable Software and Affected Versions jose4j versions prior to 0.9.4 Description The issue is related to the improper implementation of the PBES2 algorithm in the jose4j component when handling the p2c parameter. This can allow a remote attacker to cause a denial of service due to...

PT-2023-7638 · Unknown · Lestrrat-Go/Jwx

Name of the Vulnerable Software and Affected Versions: lestrrat-go/jwx versions prior to 1.2.27 lestrrat-go/jwx versions prior to 2.0.18 Description: The issue is related to the JWE key management algorithms based on PBKDF2, which require a JOSE Header Parameter called p2c PBES2 Count. This...

CVE-2022-36083: Uncontrolled Resource Consumption

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

帝友P2C借贷系统最新版前台getshell#2

简要描述： 帝友P2C借贷系统最新版前台getshell2 详细说明： 这次是帝友公司旗下出的另一套电子商务cms 不是帝友p2p！ 官方最新版本是 帝友P2C借贷系统V1.01 漏洞文件dyweb/dyusers/diyoup2c/users/users.upload.php header"Expires: Mon, 26 Jul 1997 05:00:00 GMT"; header"Last-Modified: " . gmdate"D, d M Y H:i:s" . " GMT"; header"Cache-Control: no-store, no-cache,...

帝友P2C借贷系统前台getshell#1

简要描述： 帝友P2C借贷系统前台getshell1 详细说明： 这次是帝友公司旗下出的另一套电子商务cms 不是帝友p2p！ 官方最新版本是 帝友P2C借贷系统V1.01 上传头像处存在getshell 已官方演示站做演示 已注册账号，账号密码都是test1a 访问 http://p2c.diyou.cc/?user&m=approve/safe 上传头像，抓包 修改数据包，插入一句话木马，修改后缀为php后缀 虽然回显500，但是phpshell已经上传了 dyupfiles/avatar/diyou/用户id.php 得到...