7 matches found
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57432
creationtimestamp| type| source ---|---|--- 2025-01-31 17:15:44+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lh2ispe4dc2h 2025-01-31 19:34:21+00:00| seen| https://t.me/cvedetector/16962 2025-01-31 21:35:32+00:00| seen|...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57432
The macrozheng mall-tiny development scaffolding (version 1.0.1 ) is vulnerable to Insecure Permissions due to the use of hardcoded, static JWT signing keys . Because user information is explicitly written into the JWT and utilized for subsequent privilege management, an attacker can forge a JWT ...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...