CVE-2025-55739: Use of Hard-coded Credentials

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...

CVE-2025-55739

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...

Linux Distros Unpatched Vulnerability : CVE-2021-22190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token CVE-2021-22190 Note that Nessus...

CVE-2025-51054

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint...

CVE-2025-51054

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint...

CVE-2025-51054

The Vedo Suite 2024.17 (an enterprise software suite for the textile and design industry by Bottinelli Informatica) is vulnerable to an Incorrect Access Control flaw. A remote attacker can obtain a valid high-privilege JWT token without prior authentication by sending an empty HTTP POST request t...

CVE-2025-51054

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint...

CVE-2025-51054: Improper Access Control

Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint...

CVE-2025-0249

HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization...

CVE-2025-0249: Improper Authentication

HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization...

CVE-2025-0249

CVE-2025-0249 affects HCL IEM with an improper invalidation of access or JWT tokens. The root cause is a token not being invalidated, potentially allowing unauthorized access to sensitive data. Public details in the provided documents indicate information disclosure risk (confidentiality impact) ...

CVE-2025-51864: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in AIBOX LLM chat chat.aibox365.cn through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens...

Improper Session Expiration

github.com/filebrowser/filebrowser is vulnerable to Improper Session Expiration.The vulnerability is due to the authentication system issuing long-lived JWT tokens that remain valid even after user logout, which allows an attacker to reuse tokens and gain unauthorized access to user sessions...

File Browser’s insecure JWT handling can lead to session replay attacks after logout

Summary File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. Please refer to the CWE's listed in this report for further reference and system standards. In summary, the main issue is: - Tokens remain valid after logout session replay...

GHSA-7XWP-2CPP-P8R7 File Browser’s insecure JWT handling can lead to session replay attacks after logout

Summary File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. Please refer to the CWE's listed in this report for further reference and system standards. In summary, the main issue is: - Tokens remain valid after logout session replay...

GHSA-W4XV-MJ6V-P4G2 Jenkins User1st uTester Plugin vulnerability exposes unencrypted token to authenticated users

Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53678

Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53678

Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53678

Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

CVE-2025-53678

The Jenkins User1st uTester Plugin (version 1.1 and earlier ) is vulnerable to insecure storage of sensitive information. The plugin stores the uTester JWT token unencrypted within its global configuration file (io.jenkins.plugins.user1st.utester.UTesterPlugin.xml ) on the Jenkins controller. An ...