7 matches found
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57432
creationtimestamp| type| source ---|---|--- 2025-01-31 17:15:44+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lh2ispe4dc2h 2025-01-31 19:34:21+00:00| seen| https://t.me/cvedetector/16962 2025-01-31 21:35:32+00:00| seen|...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57432
The macrozheng mall-tiny version 1.0.1 is vulnerable to an Insecure Permissions issue due to hardcoded JWT signing keys that do not change. Because user information is explicitly written into the JWT and used for privilege management, an attacker can forge the JWT of any user to achieve an authen...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...