Lucene search
+L

3609 matches found

NVD
NVD
added 2021/12/27 11:15 a.m.19 views

CVE-2021-24998

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the strshuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic...

7.5CVSS0.01186EPSS
SaveExploits0References2
OSV
OSV
added 2021/12/27 11:15 a.m.5 views

CVE-2021-24998

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the strshuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic...

7.5CVSS7.1AI score0.01186EPSS
SaveExploits0References2
Prion
Prion
added 2021/12/27 11:15 a.m.17 views

Default credentials

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the strshuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic...

5CVSS7.7AI score0.01186EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2021/12/27 10:33 a.m.65 views

CVE-2021-24998

The CVE-2021-24998 entry concerns the WordPress plugin Simple JWT Login (pre-3.3.0). The root cause is the plugin’s password generation using PHP’s non-cryptographically secure functions, specifically the use of str_shuffle to create new user passwords. This enables creation of new WordPress user...

7.5CVSS7.6AI score0.01186EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2021/12/21 5:15 p.m.28 views

CVE-2021-44877

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability ha...

7.5CVSS0.01022EPSS
SaveExploits0References1
Prion
Prion
added 2021/12/21 5:15 p.m.27 views

Improper access control

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability ha...

5CVSS7.4AI score0.01022EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2021/12/21 4:17 p.m.36 views

CVE-2021-44877

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability ha...

7.6AI score0.01022EPSS
SaveExploits0References1
CVE
CVE
added 2021/12/21 4:17 p.m.64 views

CVE-2021-44877

CVE-2021-44877 affects Dalmark Systems Systeam 2.22.8 build 1724. A broken access control flaw allows an unauthenticated attacker to use an API endpoint to generate a temporary JWT token that references the correct tenant before authentication and to request system configuration parameters. This ...

7.5CVSS7.4AI score0.01022EPSS
SaveExploits0References1Affected Software1
Mageia
Mageia
added 2021/12/19 12:26 p.m.46 views

Updated dovecot packages fix security vulnerabilities

Updated dovecot packages fix security vulnerabilities: The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension CVE-2020-28200. Dovecot before 2.3.15 allows ../ Path Traversal. An...

7.5CVSS5.1AI score0.02837EPSS
SaveExploits0References8
vulnersOsv
vulnersOsv
added 2021/12/10 6:50 p.m.4 views

fusion-plugin-jwt (>=0.1.0, <=0.1.8), toystore (>=1.1.1, <=1.5.3) potentially affected by CVE-2021-25952 via just-safe-set (1.1.0)

just-safe-set NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on just-safe-set and may be impacted: - fusion-plugin-jwt =0.1.0, =1.1.1, =1.5.3 Source cves: CVE-2021-25952 Source advisory: OSV:GHSA-V26W-GCXH-V4R7...

9.8CVSS8.6AI score0.03337EPSS
SaveExploits1
OSV
OSV
added 2021/12/10 12:00 a.m.10 views

OSV-2021-1658 Null-dereference READ in istio.io/istio/security/pkg/util.ExtractJwtAud

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42142 Crash type: Null-dereference READ Crash state: istio.io/istio/security/pkg/util.ExtractJwtAud...

7.2AI score
SaveExploits0References1
Veracode
Veracode
added 2021/11/18 8:45 a.m.24 views

Privilege Escalation

shenyu-admin is vulnerable to privilege escalation. The vulnerability exists due to an incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication...

9.8CVSS4.6AI score0.40058EPSS
SaveExploits2References3Affected Software1
Github Security Blog
Github Security Blog
added 2021/11/17 11:15 p.m.43 views

Improper Authentication in Apache ShenYu Admin

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0...

9.8CVSS8.8AI score0.40058EPSS
SaveExploits2References6Affected Software1
NVD
NVD
added 2021/11/17 11:15 a.m.26 views

CVE-2021-24804

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site...

8.8CVSS0.00612EPSS
SaveExploits2References1
Prion
Prion
added 2021/11/17 11:15 a.m.27 views

Default credentials

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site...

6.8CVSS8.5AI score0.00612EPSS
SaveExploits2References1Affected Software1
Cvelist
Cvelist
added 2021/11/17 10:15 a.m.40 views

CVE-2021-24804 Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site...

8.8AI score0.00612EPSS
SaveExploits2References1
CVE
CVE
added 2021/11/17 10:15 a.m.71 views

CVE-2021-24804

CVE-2021-24804 affects the WordPress plugin Simple JWT Login prior to version 3.2.1. The vulnerability is a CSRF/nonce-check bypass in the settings save path, allowing a logged-in administrator to modify critical options (e.g., HMAC verification secret, account registration, and default user role...

8.8CVSS8.6AI score0.00612EPSS
SaveExploits2References1Affected Software1
GithubExploit
GithubExploit
added 2021/11/17 8:33 a.m.297 views

Exploit for Improper Authentication in Apache Shenyu

Apache ShenYu Admin has a vulnerability that allows for authenti...

9.8CVSS7.2AI score0.40058EPSS
SaveExploits2
CNVD
CNVD
added 2021/11/17 12:00 a.m.98 views

Apache ShenYu licensing issue vulnerability

Apache ShenYu is an asynchronous, high-performance, cross-language, responsive API gateway from the Apache Foundation.An authorization issue vulnerability exists in Apache ShenYu Admin, which stems from a misuse of JWT in ShenuAdminBootstrap allowing an attacker to bypass authentication. No...

9.8CVSS2.6AI score0.40058EPSS
SaveExploits2References1
Prion
Prion
added 2021/11/16 10:15 a.m.17 views

Authentication flaw

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0...

7.5CVSS9.2AI score0.40058EPSS
SaveExploits2References2Affected Software1
Rows per page
Query Builder