CVE-2019-10754

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...

📄 Ruby on Rails Cross Site Request Forgery

Ruby on Rails appears to include a one time pad for cross site request forgery protections to the user, making it possible to forge valid tokens. Good morning. All current versions and all versions since the 2022/2023 "fix" to the Rails cross-site request forgery CSRF protections continue to be...

CVE-2025-27580

NIH BRICS aka Biomedical Research Informatics Computing System through 14.0.0-67 generates predictable tokens that depend on username, time, and the fixed 7Dl9dj- string and thus allows unauthenticated users with a Common Access Card CAC to escalate privileges and compromise any account, includin...

CVE-2025-2229

CVE-2025-2229 affects Philips IntelliSpace Cardiovascular (ISCV) software. A token is created using the username, current date/time, and a fixed AES-128 encryption key that is identical across all installations, enabling token duplication across environments. Reported across Philips ISCV products...

CVE-2024-29037

datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of tim...

CVE-2024-55927

A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions...

CVE-2024-55927

CVE-2024-55927 affects Xerox Workplace Suite. The flaw stems from flawed token generation and hard-coded keys, enabling potential unauthorized access to sensitive functions. Affected versions include those prior to 5.6.701.9. Remediation: update to 5.6.701.9 or later; as a temporary workaround, r...

CVE-2024-55927 Flawed token generation implementation & Hard-coded key implementation

A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions...

CVE-2024-55927 Flawed token generation implementation & Hard-coded key implementation

A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions...

Xerox Workplace Suite 信任管理问题漏洞

Xerox Workplace Suite is a powerful print management software from Xerox. A trust management issue vulnerability exists in Xerox Workplace Suite version 5.6.701.9, which stems from the use of a flawed token generation implementation and hard-coded key implementation...

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

Unauthenticated Arbitrary User Token Generation vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WPLMS versions = 1.9.9...

Inadequate Encryption Strength

github.com/apache/incubator-answer is vulnerable to Inadequate Encryption Strength. The vulnerability is due to the use of UUID v1 for token generation, which incorporates predictable elements like timestamps and node identifiers, allowing an attacker to predict or forge UUID tokens, potentially...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Priyabratasarkar Token_Login

CVE-2024-50488 Token Login = 1.0.3 - Authenticated Subscr...

JetBrains Hub Improper Access Control Vulnerability

JetBrains Hub is a Web-based identity management service launched by JetBrains, which is mainly used for centralized management of YouTrack, TeamCity and other team collaboration tools such as user authentication, permission assignment and project collaboration. JetBrains Hub suffers from an...

forgejo -- multiple vulnerabilities

Problem Description: Forgejo generates a token which is used to authenticate web endpoints that are only meant to be used internally, for instance when the SSH daemon is used to push a commit with Git. The verification of this token was not done in constant time and was susceptible to timing...

CVE-2024-24554 Bludit - Insecure Token Generation

Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API...

The vulnerability in the `index.php?c=api` script of the OneNav bookmark management interface, which allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /index.php?c=api interface of the OneNav bookmark management program is related to deficiencies in the authentication process due to incorrect generation of tokens with the X-Token parameter. Exploiting this vulnerability allows a malicious actor to compromise the...

Weak Entropy In Token Generation

friendsofsymfony/user-bundle is vulnerable to Weak Entropy in Token Generation. The vulnerability is due to the imprecise nature of the baseconvert function used in FOSUserBundle, which allows attackers to exploit the weakened randomness of tokens generated for email confirmation and password...

GHSA-PJX8-984P-7P3X FOSUserBundle Entropy is lost in the TokenGenerator

Description Because of the usage of baseconvert which looses precision for large inputs, the entropy of tokens generated by FOSUserBundle for the email confirmation and password resetting is lost. This makes these tokens much less random than they are expected to be, and so not cryptographically...

CVE-2023-50713

Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17.6 affects users who: authorized an application which requested a 'token write' scope or, using frontend-2, created a Personal Access Toke...