CVE-2024-52295

What is affected: DataEase (open source data visualization/analysis tool). Vulnerability: Prior to version 2.10.2, DataEase allows forging of JWTs to take over services. The underlying issue is that the JWT secret is hardcoded, and the UID/OID are also hardcoded. Impact: High confidentiality, int...

CVE-2024-52295 DataEase has a forged JWT token vulnerability

DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2...

GO-2024-3250 Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt

Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt...

Exploit for SQL Injection in Navidrome

CVE-2024-47062...

CVE-2024-10285

The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token...

CVE-2024-10285 CE21 Suite <= 2.2.0 - JWT Token Disclosure

The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token...

CVE-2024-10285 CE21 Suite <= 2.2.0 - JWT Token Disclosure

The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token...

CVE-2024-10285

CVE-2024-10285 describes a sensitive information disclosure in the CE21 Suite WordPress plugin (versions up to 2.2.0). The flaw allows unauthenticated attackers to access the user account tied to a valid JWT token by exploiting the plugin-log.txt, per the initial description. Public references al...

WordPress CE21 Suite plugin <= 2.2.0 - JWT Token Disclosure vulnerability

JWT Token Disclosure vulnerability discovered by István Márton in WordPress Plugin CE21 Suite versions = 2.2.0...

CVE-2024-50634

A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication...

PT-2024-34370 · Watcharr · Watcharr

Name of the Vulnerable Software and Affected Versions: Watcharr versions 1.43.0 and below Description: A vulnerability in a weak JWT token allows attackers to perform privilege escalation using a crafted JWT token. This issue is not limited to privilege escalation but also affects all functions...

CVE-2024-50634

Watcharr (v1.43.0 and earlier) contains a vulnerability in a weak JWT token that enables privilege escalation and affects all functions requiring authentication. A crafted JWT token can compromise authentication and escalate privileges across the application. Affected component: JWT-based authent...

CVE-2024-50634

A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication...

CVE-2024-50634

A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication...

CVE-2024-50634

A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication...

CVE-2024-47073

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...

CVE-2024-47073 Dataease arbitrary interface access vulnerability

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...

CVE-2024-47073 Dataease arbitrary interface access vulnerability

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...

CVE-2024-47073

DataEase v2.10.2 and earlier suffer from a missing JWT signature verification that lets an attacker forge tokens to access any interface. Multiple connected sources (including Nuclei template, Red Hat advisory, CVE listings) confirm the root cause as lack of signature verification and indicate th...

CVE-2024-48952

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints...