Improper Restriction Of Security Token Assignment

github.com/KubeOperator/kubepi is vulnerable to Improper Restriction of Security Token Assignment. The vulnerability is due to an empty JWT key in the default configuration file, which allows for a bypass of the login verification and direct backend access...

Delta Electronics DIAEnergie Hard-coded JWT Key (CVE-2022-3214)

Binary data deltaelectronicsdiaenergiecve-2022-3214.nbin...

PT-2024-17664 · Juanpao · Juanpao Jpshop

Name of the Vulnerable Software and Affected Versions: Juanpao JPShop versions up to 1.5.02 Description: A vulnerability was found in the API component of Juanpao JPShop, specifically in the file api/config/params.php. The manipulation of the JWT KEY ADMIN argument leads to the use of a hard-code...

D-Link D-View 8 Hard-coded JWT Key (CVE-2023-5074)

Binary data dlinkdview8staticjwtkey.nbin...

Control iD iDSecure Hard-coded JWT Key Authentication Bypass (CVE-2023-33371)

Binary data controlididsecurecve-2023-33371.nbin...

Moxa MXsecurity Series Hard-coded JWT Key Authentication Bypass (CVE-2023-33236)

Binary data moxamxsecuritycve-2023-33236.nbin...

Moxa MXsecurity Series Hardcoded JWT Key Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Moxa MXsecurity Series appliances. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the web-based interface. The issue results from a...

CVE-2023-27583

PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key PanIndex is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, on...

Hardcoded credentials

PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key PanIndex is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, on...

CVE-2023-27583 Panindex uses hard coded cyptographic key

PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key PanIndex is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, on...

CVE-2023-25403

CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication...

CVE-2023-25403

CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication...

CVE-2023-25403

CVE-2023-25403 affects CleverStupidDog yf-exam v1.8.0. Root cause: authentication bypass due to a fixed JWT key and a stored key that uses username-format characters. Any user who logged in within 24 hours can forge a token with their username to bypass authentication. Impact: authentication can ...

Path traversal

go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...

CVE-2022-42980

go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...

PT-2022-26691 · Goadmin · Go-Admin

Name of the Vulnerable Software and Affected Versions: go-admin aka GO Admin version 2.0.12 Description: The issue concerns the use of a hardcoded string 'go-admin' as a production JWT key in go-admin. Recommendations: For go-admin version 2.0.12, update the JWT key to a secure, randomly generate...

CVE-2022-42980

CVE-2022-42980 affects go-admin (GO Admin) 2.0.12 where the production JWT key is the literal string "go-admin". This hardcoded value can enable token forgery and unauthorized access corresponding to the high-impact CVSS rating. The available connected sources confirm the exact vulnerability—use ...

CVE-2022-42980

go-admin aka GO Admin 2.0.12 uses the string go-admin as a production JWT key...

CVE-2022-36672

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session...

CVE-2022-36672

Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session...