Hardcoded credentials

Dromara Sureness before v1.0.8 was discovered to use a hardcoded key...

Design/Logic Flaw

An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL...

Authentication flaw

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

SaToken authentication bypass vulnerability

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

CVE-2023-43961

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

CVE-2023-44794

An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL...

Dromara Sa-Token Security Breach

Sa-Token is a lightweight Java permissions authentication framework open-sourced by dromara. Dromara Sa-Token 1.36.0 and earlier versions have a security vulnerability , the vulnerability stems from allowing remote attackers to escalate privileges through a carefully designed load...

CVE-2023-44794

An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL...

CVE-2023-43961

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

CVE-2023-44794

An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL...

Dromara Sa-Token Security Breach

Sa-Token is dromara open source a lightweight Java authentication framework. Dromara Sa-Token 1.3.50RC and earlier versions of a security vulnerability , the vulnerability stems from the use of specially crafted requests may lead to authentication bypass...

SaToken privilege escalation vulnerability

An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL...

CVE-2023-43961

CVE-2023-43961 affects Dromara SaToken up to version 1.3.50RC (and earlier) when used with Spring dynamic controllers, enabling an authentication bypass via a specially crafted request. The issue is corroborated by multiple connected advisories (Red Hat, GHSA, OSV, NVD) describing an authenticati...

CVE-2023-44794

CVE-2023-44794 affects Dromara SaToken 1.36.0 and earlier. A remote attacker can escalate privileges by sending a crafted payload to the vulnerable URL, as described across multiple advisories (NVD, OSV, GHSA, IBM bulletin). The core impact stated is privilege escalation with high severity (CVSS ...

CVE-2023-43961

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

CVE-2023-31581

Dromara Sureness before v1.0.8 was discovered to use a hardcoded key...

CVE-2023-31581

Dromara Sureness before v1.0.8 was discovered to use a hardcoded key...

CVE-2023-31581

Dromara Sureness before v1.0.8 was discovered to use a hardcoded key...

CVE-2023-31581

CVE-2023-31581 affects Dromara Sureness prior to v1.0.8, where a hardcoded key is used in JSON Web Token creation and validation. This issue is documented across multiple sources (Red Hat advisory, CVE listings, OSV, GHSA) and is described as a security vulnerability in Sureness before 1.0.8. The...

PT-2023-23397 · Dromara · Dromara Sureness

Name of the Vulnerable Software and Affected Versions: Dromara Sureness versions prior to 1.0.8 Description: The issue is related to the use of a hardcoded key in Dromara Sureness. Recommendations: For versions prior to 1.0.8, update to version 1.0.8 or later to resolve the issue...