Lucene search
+L

3615 matches found

Prion
Prion
added 2022/01/04 4:15 p.m.17 views

Authentication flaw

A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864...

7.5CVSS9.7AI score0.01166EPSS
SaveExploits0References2Affected Software2
Cvelist
Cvelist
added 2022/01/04 3:40 p.m.21 views

CVE-2021-45389

A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864...

10AI score0.01166EPSS
SaveExploits0References2
CVE
CVE
added 2022/01/04 3:40 p.m.56 views

CVE-2021-45389

CVE-2021-45389 concerns StarWind SAN & NAS build 1578 and StarWind Command Center build 6864. A flaw allows a self-signed JWT token to be injected into the Update Manager, bypassing authentication and enabling privilege escalation via network access. Root cause: JWT validation/token handling flaw...

9.8CVSS9.7AI score0.01166EPSS
SaveExploits0References2Affected Software2
NVD
NVD
added 2021/12/29 5:15 p.m.20 views

CVE-2021-25993

In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged editor user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to...

5.4CVSS0.00618EPSS
SaveExploits1References2
Prion
Prion
added 2021/12/29 5:15 p.m.25 views

Cross site scripting

In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged editor user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to...

3.5CVSS5.2AI score0.00618EPSS
SaveExploits1References2Affected Software1
Cvelist
Cvelist
added 2021/12/29 4:50 p.m.26 views

CVE-2021-25993 Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor

In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged editor user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to...

5.4CVSS5.3AI score0.00618EPSS
SaveExploits1References2
NVD
NVD
added 2021/12/27 11:15 a.m.19 views

CVE-2021-24998

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the strshuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic...

7.5CVSS0.01186EPSS
SaveExploits0References2
OSV
OSV
added 2021/12/27 11:15 a.m.5 views

CVE-2021-24998

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the strshuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic...

7.5CVSS7.1AI score0.01186EPSS
SaveExploits0References2
Prion
Prion
added 2021/12/27 11:15 a.m.17 views

Default credentials

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the strshuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic...

5CVSS7.7AI score0.01186EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2021/12/27 10:33 a.m.66 views

CVE-2021-24998

The CVE-2021-24998 entry concerns the WordPress plugin Simple JWT Login (pre-3.3.0). The root cause is the plugin’s password generation using PHP’s non-cryptographically secure functions, specifically the use of str_shuffle to create new user passwords. This enables creation of new WordPress user...

7.5CVSS7.6AI score0.01186EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2021/12/21 5:15 p.m.28 views

CVE-2021-44877

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability ha...

7.5CVSS0.01022EPSS
SaveExploits0References1
Prion
Prion
added 2021/12/21 5:15 p.m.27 views

Improper access control

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability ha...

5CVSS7.4AI score0.01022EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2021/12/21 4:17 p.m.36 views

CVE-2021-44877

Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability ha...

7.6AI score0.01022EPSS
SaveExploits0References1
CVE
CVE
added 2021/12/21 4:17 p.m.64 views

CVE-2021-44877

CVE-2021-44877 affects Dalmark Systems Systeam 2.22.8 build 1724. A broken access control flaw allows an unauthenticated attacker to use an API endpoint to generate a temporary JWT token that references the correct tenant before authentication and to request system configuration parameters. This ...

7.5CVSS7.4AI score0.01022EPSS
SaveExploits0References1Affected Software1
Mageia
Mageia
added 2021/12/19 12:26 p.m.46 views

Updated dovecot packages fix security vulnerabilities

Updated dovecot packages fix security vulnerabilities: The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension CVE-2020-28200. Dovecot before 2.3.15 allows ../ Path Traversal. An...

7.5CVSS5.1AI score0.02837EPSS
SaveExploits0References8
vulnersOsv
vulnersOsv
added 2021/12/10 6:50 p.m.4 views

fusion-plugin-jwt (>=0.1.0, <=0.1.8), toystore (>=1.1.1, <=1.5.3) potentially affected by CVE-2021-25952 via just-safe-set (1.1.0)

just-safe-set NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on just-safe-set and may be impacted: - fusion-plugin-jwt =0.1.0, =1.1.1, =1.5.3 Source cves: CVE-2021-25952 Source advisory: OSV:GHSA-V26W-GCXH-V4R7...

9.8CVSS8.6AI score0.03337EPSS
SaveExploits1
OSV
OSV
added 2021/12/10 12:00 a.m.10 views

OSV-2021-1658 Null-dereference READ in istio.io/istio/security/pkg/util.ExtractJwtAud

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42142 Crash type: Null-dereference READ Crash state: istio.io/istio/security/pkg/util.ExtractJwtAud...

7.2AI score
SaveExploits0References1
Veracode
Veracode
added 2021/11/18 8:45 a.m.24 views

Privilege Escalation

shenyu-admin is vulnerable to privilege escalation. The vulnerability exists due to an incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication...

9.8CVSS4.6AI score0.40058EPSS
SaveExploits2References3Affected Software1
Github Security Blog
Github Security Blog
added 2021/11/17 11:15 p.m.43 views

Improper Authentication in Apache ShenYu Admin

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0...

9.8CVSS8.8AI score0.40058EPSS
SaveExploits2References6Affected Software1
NVD
NVD
added 2021/11/17 11:15 a.m.26 views

CVE-2021-24804

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site...

8.8CVSS0.00612EPSS
SaveExploits2References1
Rows per page
Query Builder