CVE-2021-29500

bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs...

CVE-2021-29455

Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT...

CVE-2021-29451

Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release...

CVE-2020-36255: Undefined Security Weakness

An issue was discovered in IdentityModel aka ScottBrady.IdentityModel before 1.3.0. The Branca implementation allows an attacker to modify and forge authentication tokens...

SquareBox CatDV Server Access Control Vulnerability

Square Box Systems SquareBox CatDV Server is a software application from Square Box Systems. It provides an agile media management and workflow orchestration platform. A security vulnerability exists in SquareBox CatDV Server through 9.2, which can be exploited by an attacker to generate valid...

CVE-2020-28597

A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password o...

CVE-2020-27199: Improper Authentication

The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for...

PT-2020-16661

Name of the Vulnerable Software and Affected Versions Magic Home Pro version 1.5.1 Description The Magic Home Pro application allows authentication bypass due to its simple username and password authentication function. An attacker can use enumeration to forge a user-specific token without needin...

CVE-2020-3382

A vulnerability in the REST API of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability exists because different installations share a...

Sign in with Apple JWT Token Forgery Vulnerability

Sign in with Apple is an Apple authentication mechanism. Sign in with Apple JWT token forgery vulnerability can be exploited by an attacker to forge a JWT token and gain control of the target user's account access...

CVE-2019-7644: Generation of Error Message Containing Sensitive Information

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application...

Cisco HyperFlex Critical Data States Privilege Escalation

The vulnerability of the Cisco HyperFlex hyper-converged infrastructure is related to the insecure external control of critical data states. Exploiting this vulnerability allows a malicious actor to create valid signed tokens for sessions and enhance their privileges...

GHSA-VGRX-W6RG-8FQF Forgeable Public/Private Tokens in jwt-simple

Affected versions of the jwt-simple package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the end result ...

jwt-scala Cannot Verify Token Signature Vulnerability

jwt-scala is a Scala library for processing JSON Web Token JWT. A security vulnerability exists in jwt-scala 1.2.2 and earlier versions, which stems from the program failing to properly verify token signatures. A remote attacker can exploit the vulnerability to forge a signed token with specially...

PYSEC-2017-24

In PyJWT 1.5.0 and below the invalidstrings check in HMACAlgorithm.preparekey does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enable...

CVE-2016-4907

Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors...

Microsoft Windows Local Elevation of Privilege Vulnerability (CNVD-2015-00360)

Microsoft Windows is a family of operating systems from Microsoft. Microsoft Windows Microsoft Windows Application Compatibility Infrastructure fails to properly check the authorization of caller forgery tokens, allowing attackers to exploit a vulnerability for elevated privileges...

krb5: multiple checksum handling vulnerabilities (MITKRB5-SA-2010-007)

MIT Kerberos 5 aka krb5 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via 1 an unkeyed checksum, 2 an unkeyed PAC checksum, or 3 a KrbFastArmoredRe...