NJ
Product
Nimbus JOSE+JWT
6
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 1Low 1
Watch
Add Nimbus JOSE+JWT to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-52428 | 7.5 | Feb 11 | In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the… Affected: before 9.37.2 |
| CVE-2017-12974 | 7.5 | Aug 20 | Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an… Affected: 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +34 more |
| CVE-2017-12972 | 7.5 | Aug 20 | In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by… Affected: 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +34 more |
Showing 3