JSON Web Token - API Security Blog

CVE-2023-40171

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authenticat ...

August 18, 2023

CVE-2023-39846

An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.Read More ...

August 17, 2023

CVE-2022-43485

Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerabilityÂ may allow attacker to manipulate claims in client's JWT token.Â This issue affects OneWireless version 322.1Read M ...

August 15, 2023

CVSS3 - MEDIUM

CVSS2 - MEDIUM

CVE-2023-33236

MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authenticat ...

August 15, 2023

CVSS3 - CRITICAL

CVSS2 - HIGH

CVE-2023-34088

Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker ...

August 15, 2023

CVSS3 - MEDIUM

CVSS2 - MEDIUM

CVE-2023-2827

SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON Web Token (JWT) in the HTTP request sent ...

August 15, 2023

CVSS3 - MEDIUM

CVSS2 - LOW

CVE-2023-34429

Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.Read More ...

August 15, 2023

CVSS3 - HIGH

CVSS2 - MEDIUM

CVE-2023-35134

Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding accountâs JWT token only.Read More ...

August 15, 2023

CVSS3 - MEDIUM

CVSS2 - LOW