Skip to content
Noroxi

json-jwt project records

3 published records for vendor json-jwt project.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
100%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 18
  2. 19
  3. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

3 records
  • CVE-2023-51774
    33Monitor

    The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack.

    HighCVSS 8.4No exploitEPSS 0%

    json-jwt project · json-jwtFeb 28, 2024

  • CVE-2019-18848
    30Monitor

    The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

    HighCVSS 7.5No exploitEPSS 1%

    json-jwt project · json-jwtNov 12, 2019

  • CVE-2018-1000539
    21Monitor

    Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of

    MediumCVSS 5.3No exploitEPSS 0%

    json-jwt project · json-jwtJun 26, 2018