JSON Web Token - API Security Blog

Privilege escalation in MOSN

Authentication vulnerability in MOSN before v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.Read More ...

February 17, 2023

Privilege escalation in MOSN

Authentication vulnerability in MOSN before v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.Read More ...

February 17, 2023

CVE-2021-32163

Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.Read More ...

February 17, 2023

Web-Hacking-Playground – Web Application With Vulnerabilities Found In Real Cases, Both In Pentests And In Bug Bounty Programs

[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOiFxoFzvRhwNBnCWWDl5Mys_fdLw9TCbytXhlLthbLcfBU8ZXSeAD79W_zyVDEvuGdaBEuDL80XJ_OGO3UyTAQ9VQGRTvWzRqMhJzum98YJpqEHukAeGQ5001Z7Gp6ftsjZgADy ...

February 15, 2023

openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:0353-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0353-1 advisory. - Grafana is an open source observability and data ...

February 14, 2023

CVSS3 - HIGH

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2023:0362-1)

The remote SUSE Linux SLED15 / SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0362-1 advisory. - Grafana is an open ...

February 14, 2023

CVSS3 - HIGH

Microsoft Azure Machine Learning Service JWT Cleartext Storage of Credentials Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on Microsoft Azure. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling ...

February 13, 2023

EXNESS: Double forward slash breaks server-side restrictions & allows access to prohibited services from a partner account

Hi Team, There appears to be a weird bug here. Making an API call to the prohibited endpoint appended with double/multiple slash is breaking some server-side restrictions imposed upon a partner accoun ...

February 10, 2023