1178 matches found
CVE-2022-40916: Session Fixation
Tiny File Manager v2.4.7 and below is vulnerable to session fixation...
CVE-2022-39287
tiny-csrf is a Node.js cross site request forgery CSRF protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit 8eead6d and the patch with be included in version 1.1.0. Users are advise...
CVE-2024-57435
In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure...
CVE-2024-57433
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state...
CVE-2024-57434
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...
CVE-2024-57432
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57435
In macrozheng mall-tiny version 1.0.1 , a security vulnerability exists where an attacker can send null data through the resource creation interface . This action leads to a null pointer dereference during all subsequent operations requiring authentication, resulting in a denial-of-service (DoS) ...
CVE-2024-57432
The macrozheng mall-tiny development scaffolding (version 1.0.1 ) is vulnerable to Insecure Permissions due to the use of hardcoded, static JWT signing keys . Because user information is explicitly written into the JWT and utilized for subsequent privilege management, an attacker can forge a JWT ...
CVE-2024-57433
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state...
PT-2025-3442 · Unknown · Macrozheng Mall-Tiny
Name of the Vulnerable Software and Affected Versions: macrozheng mall-tiny version 1.0.1 Description: The issue allows an attacker to send null data through the resource creation interface, resulting in a null pointer dereference in all subsequent operations that require authentication. This...
CVE-2024-57433
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state...
CVE-2024-57434
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...
CVE-2024-57434
The macrozheng mall-tiny rapid development scaffolding version 1.0.1 is vulnerable to Incorrect Access Control . The root cause is that the project imports users by default, automatically granting a test user super administrator privileges. Practical consequences include unauthorized administrati...
CVE-2024-57432: Improper Authentication
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...
CVE-2024-57435: NULL Pointer Dereference
In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure...
CVE-2024-57434: Incorrect Authorization
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...
mall-tiny 安全漏洞
mall-tiny is a rapid development scaffolding for macro individual developers. A security vulnerability exists in mall-tiny version 1.0.1, which stems from the vulnerability to incorrect access control via the logout feature...
CVE-2024-57433
macrozheng mall-tiny version 1.0.1 is vulnerable to Incorrect Access Control within the logout function. The root cause is that a user's session token remains valid and available after they have logged out, allowing the token to continue fetching information in a logged-in state. As a temporary w...
CVE-2024-57435
In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure...