CVE-2024-7401 Client Enrollment Process Bypass

Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this is a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a...

CVE-2024-7401 Client Enrollment Process Bypass

Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this is a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a...

CVE-2024-7401

CVE-2024-7401 affects Netskope Client enrollment: NSClient uses a static OrgKey token as authentication parameter, which cannot be rotated if leaked. Root cause is the static token in the enrollment flow; impact is impersonation by enrolling NSClient from a customer tenant. Public fix details are...

Netskope Client 安全漏洞

Netskope Client is a client program from Netskope, Inc. that is used to connect to manage the Netskope Cloud Platform. A security vulnerability exists in Netskope Client that stems from the use of a static token as an authentication parameter during the registration process, which can be used by ...

PT-2024-38324

Name of the Vulnerable Software and Affected Versions Netskope Client affected versions not specified Description A security issue exists in the Netskope Client enrollment process. The NSClient utilizes a static token, Orgkey, as an authentication parameter. Because this token is static, it canno...

PT-2019-11606 · Red Hat · Openshift Container Platform

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions 3.11 and later Description: A flaw was found in the cluster console component where the CSRF tokens remain static during a user's session. An attacker able to observe the value of this token could re-use ...

CVE-2018-20219

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the device sends an authentication cookie to the end user such that they can access the devices web administration panel. This token is hard-coded to a string in the source code...