2114 matches found
CVE-2025-57618
A path traversal vulnerability exists in FastX3 versions 3.3.67 and prior , allowing an unauthenticated attacker to read arbitrary files on the server. By accessing application configuration files, an attacker can obtain the secret key used to sign JSON Web Tokens (JWTs) and retrieve existing JTI...
GHSA-PQ5P-34CR-23V9 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Summary Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving...
CVE-2025-61920
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes...
UBUNTU-CVE-2025-61920
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes...
CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes...
CVE-2025-61152
Removed by vendor...
Authlib security vulnerability
Authlib is the ultimate Python library for building OAuth and OpenID Connect servers open-sourced by Authlib. A security vulnerability exists in Authlib versions prior to 1.6.5 that stems from the JOSE implementation accepting unlimited JWS/JWT headers and signature segments, which could lead to ...
CVE-2025-11290
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of...
CVE-2025-11442 JhumanJ OpnForm API Endpoint cross-site request forgery
A security flaw has been discovered in JhumanJ OpnForm up to 1.9.3. The impacted element is an unknown function of the component API Endpoint. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be...
EUVD-2016-9066
Malware in sbrugna...
EUVD-2020-24010
Malware in sbrugna...
EUVD-2017-11916
Malware in sbrugna...
EUVD-2019-0509
Malware in sbrugna...
EUVD-2021-0584
Malware in sbrugna...
EUVD-2020-20337
Malware in sbrugna...
EUVD-2018-0729
Malware in sbrugna...
EUVD-2025-32455
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of...
CVE-2025-11290
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of...
CVE-2025-11290
CRMEB up to version 5.6.1 is affected by CVE-2025-11290 due to the JWT HMAC Secret Handler component using a hard-coded cryptographic key when manipulating the secret argument (input default). The issue enables remote exploitation; exploitability is described as difficult, with a publicly availab...
CVE-2025-11290 CRMEB JWT HMAC Secret hard-coded key
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of...