CVE-2024-13111

A vulnerability classified as critical was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected by this vulnerability is an unknown functionality of the file src/main/java/com/yf/exam/modules/sys/user/controller/SysUserControl of the component JWT Token...

CVE-2024-13111

The CVE-2024-13111 entry affects Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown functionality within src/main/java/com/yf/exam/modules/sys/user/controller/SysUserControl of the JWT Token Handler, leading to improper authentication. The issue ca...

CVE-2024-13111 Beijing Yunfan Internet Technology Yunfan Learning Examination System JWT Token SysUserControl improper authentication

A vulnerability classified as critical was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected by this vulnerability is an unknown functionality of the file src/main/java/com/yf/exam/modules/sys/user/controller/SysUserControl of the component JWT Token...

CVE-2024-13111 Beijing Yunfan Internet Technology Yunfan Learning Examination System JWT Token SysUserControl improper authentication

A vulnerability classified as critical was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected by this vulnerability is an unknown functionality of the file src/main/java/com/yf/exam/modules/sys/user/controller/SysUserControl of the component JWT Token...

Sensitive Information Disclosure

Navidrome is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of sensitive information because the JWT secret is stored in plaintext in the navidrome.db database file, making it retrievable by anyone with access to the database...

CVE-2024-43441 Apache HugeGraph-Server: Fixed JWT Token(Secret)

Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue...

CVE-2024-43441

Apache HugeGraph-Server

Navidrome Stores JWT Secret in Plaintext in navidrome.db

Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. The JWT secret is critical for the authentication and authorization system. If...

GHSA-XWX7-P63R-2RJ8 Navidrome Stores JWT Secret in Plaintext in navidrome.db

Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. The JWT secret is critical for the authentication and authorization system. If...

CVE-2024-56362

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. Th...

CVE-2024-56362 Navidrome Stores JWT Secret in Plaintext in navidrome.db

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. Th...

CVE-2024-56362

Navidrome is affected by CVE-2024-56362, a vulnerability where the JWT secret is stored in plaintext in the navidrome.db database file under the property table. This insecure storage allows anyone with access to the database file to retrieve the secret, potentially enabling token forgery and acco...

CVE-2024-56362 Navidrome Stores JWT Secret in Plaintext in navidrome.db

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. Th...

CVE-2024-56362 Navidrome Stores JWT Secret in Plaintext in navidrome.db

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. Th...

MAL-2024-12104 Malicious code in oauth2-jwt-bearer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 36fb17415b72312cf7dda66e2cfcb35ec7340bb75ae0fd7dfe1b3821f8039579 The OpenSSF Package Analysis project identified 'oauth2-jwt-bearer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in oauth2-jwt-bearer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 36fb17415b72312cf7dda66e2cfcb35ec7340bb75ae0fd7dfe1b3821f8039579 The OpenSSF Package Analysis project identified 'oauth2-jwt-bearer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in quintoandar-jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36d0f52e6a3bbd3fdbc84b19ad4b18ff69ea20aa7dbb1fd508917d33072259ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11200 Malicious code in quintoandar-jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36d0f52e6a3bbd3fdbc84b19ad4b18ff69ea20aa7dbb1fd508917d33072259ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

VulnCheck KEV: CVE-2024-36111

KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the...