3625 matches found
CVE-2023-27583 Panindex uses hard coded cyptographic key
PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key PanIndex is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, on...
CVE-2023-27583 Panindex uses hard coded cyptographic key
PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key PanIndex is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, on...
CVE-2023-27583
CVE-2023-27583 affects PanIndex prior to version 3.1.3, where a hard-coded JWT signing key named “PanIndex” enables an attacker to forge tokens and perform admin actions. The issue is mitigated by upgrading to 3.1.3, which ships a patch. As a temporary workaround, the source code can be modified ...
SQL Injection
zoneminder is vulnerable to SQL Injection attacks. An attacker could use a malicious JWT token to execute SQL queries, as the Username field of the JWT token was trusted. If the HASH key used by ZoneMinder was determined, the attacker could generate a malicious JWT token and use it to execute...
CVE-2023-25403
CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication...
Authentication flaw
CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication...
CVE-2023-25403
CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication...
CVE-2023-25403
CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication...
CVE-2023-25403
CVE-2023-25403 affects CleverStupidDog yf-exam v1.8.0. Root cause: authentication bypass due to a fixed JWT key and a stored key that uses username-format characters. Any user who logged in within 24 hours can forge a token with their username to bypass authentication. Impact: authentication can ...
Lemur subject to insecure random generation
Overview Lemur was using insecure random generation for its example configuration file, as well as for some utilities. Impact The potentially affected generated items include: | Configuration item | Config option name if applicable | Documentation link if applicable | Rotation option | Code...
GHSA-5FQV-MPJ8-H7GM Lemur subject to insecure random generation
Overview Lemur was using insecure random generation for its example configuration file, as well as for some utilities. Impact The potentially affected generated items include: | Configuration item | Config option name if applicable | Documentation link if applicable | Rotation option | Code...
CVE-2023-26032
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL...
CVE-2023-26032
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL...
CVE-2023-26032
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL...
CVE-2023-26032 ZoneMinder contains SQL injection via malicious Jason Web Token
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL...
CVE-2023-26032
ZoneMinder is affected by a SQL Injection in versions prior to 1.36.33 and 1.37.33 via a malicious JSON Web Token. The vulnerability arises because the Username field of the JWT token is trusted during SQL queries, enabling an attacker who can determine the JWT HASH key to forge a token and execu...
K68146245: Apache Pulsar vulnerability CVE-2021-22160
Security Advisory Description If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens JWT, the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user...
Privilege Escalation
github.com/mosn/mosn is vulnerable to Privilege Escalation. The vulnerability exists due to the prefixMatcher function in matcher.go while using JWT authorization, which is case-sensitive to the prefix that the URL matches, which may result in authentication bypass...