https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 18:23:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-65308 EUVD-2026-65308 https://cve.radiocsirt.org/vuln/euvd-2026-65308 https://cve.radiocsirt.org/vuln/fkie_cve-2018-11537 <p>Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.</p> <p>Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-11537 https://cve.radiocsirt.org/vuln/ghsa-vm2p-f5j4-mj6g <p><strong>Affected:</strong> npm: angular-jwt</p> <p>Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the `jwtInterceptorProvider.whiteListedDomains` setting to bypass the domain allowlist filter via a crafted domain.</p> <p>For example, if the setting is initialized with:</p> <p>`jwtInterceptorProvider.whiteListedDomains = [&#39;whitelisted.Example.com&#39;];`</p> <p>An attacker can set up a domain `whitelistedXexample.com` that will pass the allow list filter, as it considers the `.` separator to be a regex whildcard which matches any character.</p> <p><strong>Affected:</strong> npm: angular-jwt</p> <p>Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the `jwtInterceptorProvider.whiteListedDomains` setting to bypass the domain allowlist filter via a crafted domain.</p> <p>For example, if the setting is initialized with:</p> <p>`jwtInterceptorProvider.whiteListedDomains = [&#39;whitelisted.Example.com&#39;];`</p> <p>An attacker can set up a domain `whitelistedXexample.com` that will pass the allow list filter, as it considers the `.` separator to be a regex whildcard which matches any character.</p> https://cve.radiocsirt.org/vuln/ghsa-vm2p-f5j4-mj6g https://cve.radiocsirt.org/vuln/gsd-2018-11537 gsd-2018-11537 https://cve.radiocsirt.org/vuln/gsd-2018-11537