WaratekVRT Sign in

CWE-1259 CVEs

2 CVEs

Reset
More filters (1)
Columns
CWE CWE-1259✕
Overview 2 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
2matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 100.0%
Critical 0 0.0% High 1 50.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 50.0% Forecast only 0 0.0% No public exploit 1 50.0%
split by peak 1 / month
No exploit published: 2 Medium: 1High: 1 not blocked: 2 No public exploit: 1Proof of concept only: 1
Aug 241 No exploit published1 Medium1 not blocked1 No public exploit1 Sep 240 Oct 240 Nov 240 Dec 240 Jan 250 Feb 250 Mar 250 Apr 250 May 250 Jun 250 Jul 250 Aug 250 Sep 250 Oct 250 Nov 250 Dec 251 No exploit published1 High1 not blocked1 Proof of concept only1
Aug 24Oct 24Dec 24Feb 25Apr 25Jun 25Aug 25Oct 25Dec 25
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-29371 High 2025-12-17 No exploit published Proof of concept only In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
CVE-2024-41948 Medium 2024-08-01 No exploit published No public exploit biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary info to generate a third-party block and to sign it, which includes the public key of the previous block (used in the signature) and the public keys part of the token symbol table (for public key interning in datalog expressions). A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair. This vulnerability is fixed in 4.0.0.