CVE-2023-39846

An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...

CVE-2023-39846

An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...

CVE-2023-39846

An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...

CVE-2023-35134

Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only...

CVE-2023-34429

Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token...

CVE-2023-34429

Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token...

Default credentials

Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only...

Design/Logic Flaw

Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token...

CVE-2023-34429 Weintek Weincloud Improper Handling of Structural Elements

Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token...

CVE-2023-34429 Weintek Weincloud Improper Handling of Structural Elements

Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token...

CVE-2023-35134 Weintek Weincloud Weak Password Recovery Mechanism for Forgotten Password

Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only...

CVE-2023-35134

CVE-2023-35134 affects Weintek Weincloud v0.13.6, where an attacker could reset an account’s password using only the JWT token. The ICS advisory notes an authenticated/remote exposure with the account API; CISA recommends upgrading to the fixed account API version (v0.13.8) and applying standard ...

PT-2023-25159 · Weintek · Weintek Weincloud

Name of the Vulnerable Software and Affected Versions: Weintek Weincloud version 0.13.6 Description: The issue allows an attacker to reset a password using the corresponding account's JWT token only. No information is provided about the estimated number of potentially affected devices worldwide o...

Weintek Weincloud

1. EXECUTIVE SUMMARY ​CVSS v3 7.5 ​ATTENTION: Exploitable remotely/low attack complexity ​Vendor: Weintek ​Equipment: Weincloud ​Vulnerabilities: Weak Password Recovery Mechanism for Forgotten Password, Improper Authentication, Improper Restriction of Excessive Authentication Attempts, Improper...

Information Disclosure

io.ktor is vulnerable to Information Disclosure. The vulnerability exists due to improper masking of credentials inside exception messages, which allows an attack to exfiltrate the JWT token by sending a crafted message which results in an exception being thrown that displays the full header...

CVE-2022-43485

Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1...

Design/Logic Flaw

Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1...

CVE-2022-43485

CVE-2022-43485 affects Honeywell OneWireless WDM 322.1, due to use of insufficiently random values for signing tokens, potentially allowing attacker to manipulate client JWT claims. Remediation: upgrade to OneWireless 322.2 (as per Honeywell/ICS guidance). Several sources (Red Hat, PRION, CNNVD, ...

CVE-2022-43485 Insecure random number used for generating keys for signing Jwt tokens

Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1...

CVE-2022-43485 Insecure random number used for generating keys for signing Jwt tokens

Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1...