144 matches found
CVE-2024-22281 Apache Helix Front (UI): Helix front hard-coded secret in the express-session
UNSUPPORTED WHEN ASSIGNED The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that...
PT-2024-19302 · Apache · Apache Helix Front
Name of the Vulnerable Software and Affected Versions: Apache Helix Front UI versions all Description: The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects products that are no longer...
Apache Submarine Commons Utils has a hard-coded secret
Improper Authentication vulnerability in Apache Submarine Commons Utils. This issue affects Apache Submarine Commons Utils: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. If the user doesn't explicitly set submarine.auth.default.secret, a defaul...
GHSA-JWCG-WV5X-VG3G Apache Submarine Commons Utils has a hard-coded secret
Improper Authentication vulnerability in Apache Submarine Commons Utils. This issue affects Apache Submarine Commons Utils: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. If the user doesn't explicitly set submarine.auth.default.secret, a defaul...
CVE-2024-29855
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator...
D-Tale Input Validation Error Vulnerability
Man Group D-Tale is a pandas data structure visualization tool from Man Group, Inc. An input validation error vulnerability exists in D-Tale, which stems from a hard-coded SECRETKEY in the flask configuration, which allows an attacker to forge a session cookie if authentication is enabled...
CVE-2024-32988
The CVE covers the OfferBox Android apps (2.0.0–2.3.17) and iOS apps (2.1.7–2.6.14) that embed a hard-coded JWT secret in the binary, enabling retrieval by reverse engineering. The root cause is a hard-coded secret key used for JWT authentication, which poses confidentiality risk if extracted. Pu...
CVE-2024-32988
'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT may be retrieved if the application binary is reverse-engineered...
PT-2024-25035 · Unknown · Offerbox App For Android +1
Name of the Vulnerable Software and Affected Versions: OfferBox App for Android versions 2.0.0 through 2.3.17 OfferBox App for iOS versions 2.1.7 through 2.6.14 Description: The 'OfferBox' App for Android and iOS uses a hard-coded secret key for JWT. This secret key may be retrieved if the...
CVE-2024-23816
A vulnerability has been identified in Location Intelligence Perpetual Large 9DE5110-8CA13-1AX0 All versions V4.3, Location Intelligence Perpetual Medium 9DE5110-8CA12-1AX0 All versions V4.3, Location Intelligence Perpetual Non-Prod 9DE5110-8CA10-1AX0 All versions V4.3, Location Intelligence...
CVE-2024-23816
A vulnerability has been identified in Location Intelligence Perpetual Large 9DE5110-8CA13-1AX0 All versions V4.3, Location Intelligence Perpetual Medium 9DE5110-8CA12-1AX0 All versions V4.3, Location Intelligence Perpetual Non-Prod 9DE5110-8CA10-1AX0 All versions V4.3, Location Intelligence...
CVE-2024-23816
CVE-2024-23816 affects Siemens Location Intelligence products (Perpetual Large/Medium/Non-Prod/Small and SUS Large/Medium/Non-Prod/Small). Root cause: use of a hard-coded secret for Keyed-Hash Message Authentication Code computation, enabling an unauthenticated remote attacker to gain full admini...
CVE-2024-23816
A vulnerability has been identified in Location Intelligence Perpetual Large 9DE5110-8CA13-1AX0 All versions V4.3, Location Intelligence Perpetual Medium 9DE5110-8CA12-1AX0 All versions V4.3, Location Intelligence Perpetual Non-Prod 9DE5110-8CA10-1AX0 All versions V4.3, Location Intelligence...
CVE-2024-23816
A vulnerability has been identified in Location Intelligence Perpetual Large 9DE5110-8CA13-1AX0 All versions V4.3, Location Intelligence Perpetual Medium 9DE5110-8CA12-1AX0 All versions V4.3, Location Intelligence Perpetual Non-Prod 9DE5110-8CA10-1AX0 All versions V4.3, Location Intelligence...
PT-2024-1621 · Unknown · Location Intelligence Sus Non-Prod +7
Name of the Vulnerable Software and Affected Versions: Location Intelligence Perpetual Large versions prior to V4.3 Location Intelligence Perpetual Medium versions prior to V4.3 Location Intelligence Perpetual Non-Prod versions prior to V4.3 Location Intelligence Perpetual Small versions prior to...
CVE-2023-47315
Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens...
CVE-2023-47315
Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens...
PT-2023-9023 · Headwind · Headwind Mdm Web Panel
Name of the Vulnerable Software and Affected Versions: Headwind MDM Web panel version 5.22.1 Description: The issue is related to the use of hard-coded credentials in the JWT Secret Handler component of the Headwind MDM software. This allows a remote attacker to gain access to credentials by...
Authentication flaw
European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5...