https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:15:55 +0000 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23529 <p>Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The issue is not a vulnerability. Notes: none.</p> <p>Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The issue is not a vulnerability. Notes: none.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-23529 https://cve.radiocsirt.org/vuln/ghsa-27h2-hvpr-p74q <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: jsonwebtoken</p> <p># Overview</p> <p>For versions `&lt;=8.5.1` of `jsonwebtoken` library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) of the `jwt.verify()` function, they can gain remote code execution (RCE).</p> <p># Am I affected?</p> <p>This security issue is a concern when the `jsonwebtoken` library is used in an insecure way. Users are affected only if they allow untrusted entities to modify the key retrieval parameter of the `jwt.verify()` on a host that you control. In this scenario, if all the prerequisites are met, the issue may be exploitable. The source of this risk in this scenario would be in the calling code, and not in the library itself.</p> <p># How do I fix it?</p> <p>Users of jsonwebtoken 8.5.1 and earlier are encouraged to update to the latest version, 9.0.0, which presents safer code and important security checks that fixes this security flaw and others and prevents misuse of the package.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: jsonwebtoken</p> <p># Overview</p> <p>For versions `&lt;=8.5.1` of `jsonwebtoken` library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) of the `jwt.verify()` function, they can gain remote code execution (RCE).</p> <p># Am I affected?</p> <p>This security issue is a concern when the `jsonwebtoken` library is used in an insecure way. Users are affected only if they allow untrusted entities to modify the key retrieval parameter of the `jwt.verify()` on a host that you control. In this scenario, if all the prerequisites are met, the issue may be exploitable. The source of this risk in this scenario would be in the calling code, and not in the library itself.</p> <p># How do I fix it?</p> <p>Users of jsonwebtoken 8.5.1 and earlier are encouraged to update to the latest version, 9.0.0, which presents safer code and important security checks that fixes this security flaw and others and prevents misuse of the package.</p> https://cve.radiocsirt.org/vuln/ghsa-27h2-hvpr-p74q https://cve.radiocsirt.org/vuln/gsd-2022-23529 gsd-2022-23529 https://cve.radiocsirt.org/vuln/gsd-2022-23529 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0218 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM Integration Bus ausnutzen, um beliebigen Programmcode auszuführen oder Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM Integration Bus ausnutzen, um beliebigen Programmcode auszuführen oder Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0218