CVE-2021-40903

Título del Exploit: Antminer Monitor 0.5.0 - Bypass de Autenticación CVE: CVE-2021-40903 Fecha: 09/06/2021 Dork:https://www.zoomeye.org/searchResult?q=%22antminer%20monitor%22 Autor del Exploit: CQR.company / Vulnz. Página del Vendedor: https://github.com/anselal/antminer-monitor,...

CVE-2026-21994

CVE-2026-21994 Zusammenfassung Oracle OKIT oci-designer-toolkit Version 0.3.0 enthält zwei kritische Fehlkonfigurationen, die sich zu einer vollständigen Übernahme ohne Authentifizierung verketten. Ein hartcodierter Flask-SECRETKEY, der im öffentlichen Repository offengelegt ist, erlaubt jedem...

Research-CVE-2023-27524

Recherche-CVE-2023-27524 La compétition Asean Student Information Security Sinh viên An toàn Thông tin s’est temporairement achevée, l’équipe MSECHUNT3R a remporté la deuxième place du tableau Jeopardy. Je suis à la fois content et triste car le web cette année n’a pas répondu à mes attentes, mai...

CVE-2023-27524

CVE-2023-27524: Apache Superset 认证绕过 用于检查 Apache Superset 服务器是否运行在不安全默认配置下的脚本 CVE-2023-27524。该脚本检查 Superset 服务器的会话 cookie 是否使用任何已知的默认 Flask SECRETKEY 进行签名。 --validate 标志可用于通过 Superset API 枚举数据库来验证可利用性。 博客文章 更多详细信息请参见：...

CVE-2026-78553

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

CVE-2026-75870

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie...

CVE-2026-75870 Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie...

EUVD-2026-64294

Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie...

CVE-2026-75870

CVE-2026-75870 affects the Punk Perl web framework (by LNATION) in versions before 0.18 . When the session keyword is declared without a secret option (or with an undefined/empty one), both cookie read and write-back default the HMAC key to an empty string , resulting in a zero-length HMAC-SHA256...

PT-2026-76959

Name of the Vulnerable Software and Affected Versions Zabbix version 7.4 Description The cryptographic key used for signing Frontend sessions is incorrectly written to the database seed. This issue affects deployments that simultaneously use SAML authentication and guest users, allowing the key t...

CVE-2026-72793

SiYuan before v3.7.4 exposes sensitive configuration data via /api/system/getConf. The root cause is failure to mask fields such as the session-cookie signing key, OS username (via pandoc path), and encrypted-notebook key material, enabling anonymous or publish-reader users to access these secret...

CVE-2026-72794

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access...

CVE-2026-45336 HireFlow: Use of Hard-coded Credentials

HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secretkey used to sign session cookies, allowing unauthenticated attackers who know the public source value to...

SODOLA SL902-SWTGW124AS 安全漏洞

SODOLA SL902-SWTGW124AS is an industrial switch produced by the Spanish company SODOLA. Versions of SODOLA SL902-SWTGW124AS prior to version 200.1.20 contain security vulnerabilities. These vulnerabilities stem from the use of the MD5 hash function, which has weak encryption strength. This can...

Linux Distros Unpatched Vulnerability : CVE-2024-58134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These...

CVE-2024-58134

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute...

CVE-2024-58134

CVE-2024-58134 (Mojolicious on Perl): Affected versions are Mojolicious 0.999922 and later up to 9.39, where the HMAC session cookie secret is derived from a hard-coded string or the app class name by default. This predictable secret enables an attacker who learns or guesses the secret to forge v...

PT-2025-18947 · Unknown +1 · Mojolicious +1

Name of the Vulnerable Software and Affected Versions: Mojolicious versions 0.999922 through 9.39 Description: The issue concerns the use of a hard-coded string or the application's class name as a HMAC session secret by default in Mojolicious for Perl. This predictable default secret can be...

CVE-2024-3408

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

D-Tale Input Validation Error Vulnerability

Man Group D-Tale is a pandas data structure visualization tool from Man Group, Inc. An input validation error vulnerability exists in D-Tale, which stems from a hard-coded SECRETKEY in the flask configuration, which allows an attacker to forge a session cookie if authentication is enabled...