90 matches found
some-tweak-to-hide-jwt-payload-values
some-tweak-to-hide-jwt-payload-values JWT 페이로드를 보호하기 위한 몇 가지 조정 및 아이디어로, 값을 지속적으로 변경하여 디코딩을 무의미하게 만들고, 디코딩된 출력이 이해 불가능하도록 보장하면서 성능 오버헤드를 최소화합니다. JWT 토큰이란? JSON 웹 토큰 JWT, "jot"으로 발음은 두 당사자 간에 JSON 메시지를 전달하는 간결하고 URL-안전한 방법입니다. RFC 7519에 정의된 표준입니다. 토큰은 점으로 구분된 여러 부분으로 나뉜 긴 문자열입니다. 각 부분은 base64 URL로...
CVE-2026-61458
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any...
GHSA-XW5C-JC7X-GF75 PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability
PAC4J is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the...
CVE-2026-24318
Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If the application continues to accept previously issued toke...
CVE-2026-32943 Parse Server has a password reset token single-use bypass via concurrent requests
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated token can be...
CVE-2026-28678
...
openclaw-security-quiz
🔒 Security & Best Practices Quiz A mobile-friendly quiz app w...
security-antipatterns-javascript
Security Anti-Patterns for JavaScript AI coding agents don't...
CVE-2021-27884
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...
CVE-2022-31142
@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...
[SECURITY] Fedora 43 Update: openbao-2.4.4-1.fc43
Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...
CVE-2025-36249
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to...
PT-2025-44624
Name of the Vulnerable Software and Affected Versions IBM Jazz for Service Management versions 1.1.3.0 through 1.1.3.25 Description The software does not set the secure attribute on authorization tokens or session cookies. This could allow attackers to obtain cookie values by sending an insecure...
CVE-2025-62794
GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" ap...
EUVD-2025-36570
GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" ap...
CVE-2025-61152
Removed by vendor...
Malicious Package
Overview tokensecuritycheck is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in token_security_check (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b62a85484e47dd76287cbde832200d5fed78a12b681c06710549f39f11bb433 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-48238 Malicious code in token_security_check (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b62a85484e47dd76287cbde832200d5fed78a12b681c06710549f39f11bb433 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...