CVE-2025-49152

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

CVE-2025-49151

The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens JWT to bypass authentication...

CVE-2025-49152

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

CVE-2025-49151

The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens JWT to bypass authentication...

CVE-2025-49152

CVE-2025-49152 affects MICROSENS NMP Web+ where issued JWTs do not expire, enabling potential unauthenticated access. Connected documents confirm that tokens can be forged or used to bypass authentication, potentially allowing file overwrites or arbitrary code execution in affected products. Affe...

CVE-2025-49152 Insufficient Session Expiration in MICROSENS NMP Web+

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

CVE-2025-49152 Insufficient Session Expiration in MICROSENS NMP Web+

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

CVE-2025-49151

CVE-2025-49151 affects MICROSENS NMP Web+; an unauthenticated attacker could forge JSON Web Tokens (JWT) to bypass authentication. PT-2025-26855 specifies affected versions: MICROSENS NMP Web+ prior to 3.3.0, with a fix in 3.3.0. The risk is described as enabling unauthorized access and potential...

CVE-2025-49151 Use of Hard-coded, Security-relevant Constants in MICROSENS NMP Web+

The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens JWT to bypass authentication...

CVE-2025-49151 Use of Hard-coded, Security-relevant Constants in MICROSENS NMP Web+

The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens JWT to bypass authentication...

CVE-2025-49152: Insufficient Session Expiration

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

PT-2025-26856 · Microsens · Microsens Nmp Web+

Name of the Vulnerable Software and Affected Versions: MICROSENS NMP Web+ affected versions not specified Description: The issue concerns JSON Web Tokens JWT that do not expire in MICROSENS NMP Web+, potentially allowing an attacker to gain access to the system. Recommendations: At the moment,...

PT-2025-26855 · Microsens · Microsens Nmp Web+

Name of the Vulnerable Software and Affected Versions: MICROSENS NMP Web+ versions prior to 3.3.0 Description: The issue allows an unauthenticated attacker to generate forged JSON Web Tokens JWT to bypass authentication. This could potentially lead to full system control. Organizations worldwide...

Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities

Summary IBM Guardium Data Security Center has addressed these vulnerabilities with an update Vulnerability Details CVEID:CVE-2024-51744 DESCRIPTION: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where use...

TencentOS Server 4: osbuild-composer (TSSA-2025:0333)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0333 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

GFI Archiver 信任管理问题漏洞

GFI Archiver is an e-mail archiving software from GFI, Inc. for protecting, storing and retrieving your electronic communications. GFI Archiver suffers from a trust management issue vulnerability that stems from hard-coding JWT signing keys, which could lead to unauthorized access...

CVE-2023-46943

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens JWTs, allowing them access t...

CVE-2021-29455

Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT...

CVE-2021-29500

bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs...

CVE-2021-29451

Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release...