Connect2id records
5 published records for vendor connect2id.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-345 Insufficient Verification of Data Authenticity1
- CWE-347 Improper Verification of Cryptographic Signature1
- CWE-354 Improper Validation of Integrity Check Value1
- CWE-755 Improper Handling of Exceptional Conditions1
- CWE-770 Allocation of Resources Without Limits or Throttling1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
42Plan | CVE-2019-17195Proof of concept | Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crashconnect2id · nimbus jose\+jwt · CWE-755 | Critical9.8 | — | 11.1% | Oct 15, 2019 |
30Monitor | CVE-2017-12974No exploit | Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curveconnect2id · nimbus jose\+jwt · CWE-347 | High7.5 | — | 1.2% | Aug 20, 2017 |
30Monitor | CVE-2017-12972No exploit | In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers connect2id · nimbus jose\+jwt · CWE-345 | High7.5 | — | 0.8% | Aug 20, 2017 |
30Monitor | CVE-2023-52428No exploit | In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header valconnect2id · nimbus jose\+jwt · CWE-770 | High7.5 | — | 0.8% | Feb 11, 2024 |
12Monitor | CVE-2017-12973No exploit | Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackeconnect2id · nimbus jose\+jwt · CWE-354 | Low3.1 | — | 0.6% | Aug 20, 2017 |
- CVE-2019-1719542Plan
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash
CriticalCVSS 9.8Proof of conceptEPSS 11%connect2id · nimbus jose\+jwtOct 15, 2019
- CVE-2017-1297430Monitor
Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve
HighCVSS 7.5No exploitEPSS 1%connect2id · nimbus jose\+jwtAug 20, 2017
- CVE-2017-1297230Monitor
In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers
HighCVSS 7.5No exploitEPSS 0%connect2id · nimbus jose\+jwtAug 20, 2017
- CVE-2023-5242830Monitor
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header val
HighCVSS 7.5No exploitEPSS 0%connect2id · nimbus jose\+jwtFeb 11, 2024
- CVE-2017-1297312Monitor
Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attacke
LowCVSS 3.1No exploitEPSS 0%connect2id · nimbus jose\+jwtAug 20, 2017