CVE-2025-49152

CVE-2025-49152 affects MICROSENS NMP Web+ where issued JWTs do not expire, enabling potential unauthenticated access. Connected documents confirm that tokens can be forged or used to bypass authentication, potentially allowing file overwrites or arbitrary code execution in affected products. Affe...

CVE-2025-49152 Insufficient Session Expiration in MICROSENS NMP Web+

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

CVE-2025-49151 Use of Hard-coded, Security-relevant Constants in MICROSENS NMP Web+

The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens JWT to bypass authentication...

CVE-2025-49151

CVE-2025-49151 affects MICROSENS NMP Web+; an unauthenticated attacker could forge JSON Web Tokens (JWT) to bypass authentication. PT-2025-26855 specifies affected versions: MICROSENS NMP Web+ prior to 3.3.0, with a fix in 3.3.0. The risk is described as enabling unauthorized access and potential...

CVE-2025-49151 Use of Hard-coded, Security-relevant Constants in MICROSENS NMP Web+

The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens JWT to bypass authentication...

PT-2025-26856 · Microsens · Microsens Nmp Web+

Name of the Vulnerable Software and Affected Versions: MICROSENS NMP Web+ affected versions not specified Description: The issue concerns JSON Web Tokens JWT that do not expire in MICROSENS NMP Web+, potentially allowing an attacker to gain access to the system. Recommendations: At the moment,...

PT-2025-26855 · Microsens · Microsens Nmp Web+

Name of the Vulnerable Software and Affected Versions: MICROSENS NMP Web+ versions prior to 3.3.0 Description: The issue allows an unauthenticated attacker to generate forged JSON Web Tokens JWT to bypass authentication. This could potentially lead to full system control. Organizations worldwide...

VulnCheck KEV: CVE-2023-22893

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that...

CLSA-2025-1750444475 open-vm-tools: Fix of 2 CVEs

CVE-2023-34058: don't accept tokens with unrelated certs - CVE-2023-34059: fix file descriptor vuln by moving privilege drop from suidWrapper to vmtoolsd...

CVE-2025-32878

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is mainly for downloading firmware files. Before downloading firmware files, the watch requests some information about the firmware via HTTPS from the back-end...

Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities

Summary IBM Guardium Data Security Center has addressed these vulnerabilities with an update Vulnerability Details CVEID:CVE-2024-51744 DESCRIPTION: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where use...

Centre Driven Controlled Evolution of Wireless Virtual Networks Based on Broadcast Tokens

In a wireless sensor network, the virtual connectivity between nodes is a function of the keys shared between various nodes. Pre-embedding these key configurations in the nodes would make the network inflexible. On the other hand, permitting subsets of nodes to engage in a common key synthesis...

Malicious code in compound-design-tokens (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e796e34437556a1ebb4437a1047206b9f42ef8ee3426f6aacad4ac14b318c41c Any computer that has this package installed or running should be considered...

MAL-2025-5224 Malicious code in compound-design-tokens (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e796e34437556a1ebb4437a1047206b9f42ef8ee3426f6aacad4ac14b318c41c Any computer that has this package installed or running should be considered...

CVE-2025-49593 Portainer HTTP Headers May Leak to Malicious Container Registries

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a maliciou...

CVE-2025-49593

CVE-2025-49593 affects Portainer Community Edition prior to STS 2.31.0 and LTS 2.27.7. When an administrator is convinced to register a malicious container registry (or an existing registry is taken over), HTTP Headers including registry credentials and Portainer session tokens may be leaked to t...

ash_authentication_phoenix has Insufficient Session Expiration

Impact Session tokens remain valid on the server after user logout, creating a security gap where: - Compromised tokens via XSS, network interception, or device theft continue to work even after the user logs out - The sessions stored in the database still expire, limiting the duration during whi...

Proposal for Improving Google A2A Protocol: Safeguarding Sensitive Data in Multi-Agent Systems

A2A, a protocol for AI agent communication, offers a robust foundation for secure AI agent communication. However, it has several critical issues in handling sensitive data, such as payment details, identification documents, and personal information. This paper reviews the existing protocol,...

PT-2025-25659

Name of the Vulnerable Software and Affected Versions ash-project ash authentication phoenix versions prior to 2.10.0 Description The issue affects the ash authentication phoenix library, where session tokens remain valid on the server after a user logs out. This creates a security gap where...

TencentOS Server 4: osbuild-composer (TSSA-2025:0333)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0333 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...