Golf 跨站请求伪造漏洞

Golf is a fast, simple, and lightweight web framework for individual developers at Peixuan Ding. Golf suffers from a cross-site request forgery vulnerability that stems from an insecurely generated CSRF token. An attacker can exploit this vulnerability to predict CSRF tokens...

CVE-2022-23741 Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in...

CVE-2022-44938

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack...

CVE-2022-29808

In Quest KACE Systems Management Appliance SMA through 12.0, predictable token generation occurs when appliance linking is enabled...

CVE-2022-29808

In Quest KACE Systems Management Appliance SMA through 12.0, predictable token generation occurs when appliance linking is enabled...

CVE-2022-29808

In Quest KACE Systems Management Appliance SMA through 12.0, predictable token generation occurs when appliance linking is enabled...

CVE-2022-29808

CVE-2022-29808 affects Quest KACE Systems Management Appliance (SMA) up to and including 12.0, where appliance linking enables predictable token generation. This is the root cause described in connected records, tied to SMA versions prior to 12.0 and remediated by upgrading to 12.0 or later. The ...

PT-2022-19842 · Quest · Quest Kace System Management Appliance

Name of the Vulnerable Software and Affected Versions: Quest KACE Systems Management Appliance SMA versions prior to 12.0 Description: The issue is related to predictable token generation when appliance linking is enabled. Recommendations: For versions prior to 12.0, update to version 12.0 or lat...

Design/Logic Flaw

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values...

PT-2022-17063 · Cwp · Cwp

Name of the Vulnerable Software and Affected Versions: CWP version 0.9.8.1126 Description: The password reset token is generated using known or predictable values. Recommendations: For CWP version 0.9.8.1126, consider disabling the password reset feature until a patch is available to prevent...

Jwtear - Modular Command-Line Tool To Parse, Create And Manipulate JWT Tokens For Hackers

A modular command-line tool to parse, create and manipulate JSON Web TokenJWT tokens for security testing purposes. Features Complete modularity. All commands are plugins. Easy to add new plugins. Support JWS and JWE tokens. Easy interface for plugins. follow the template example Flexible token...

Offensive-Azure - Collection Of Offensive Tools Targeting Microsoft Azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

CVE-2022-29185

CVE-2022-29185 affects the Rust library totp-rs. Prior to version 1.1.0, token comparison was not constant time, which could theoretically allow guessing a TOTP token value and reusing it within the same time window, assuming the attacker knew the password. Patch 1.1.0 introduces a constant-time ...

CVE-2022-26779

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate...

Code injection

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate...

CVE-2022-26779 Apache Cloudstack insecure random number generation affects project email invitation

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate...

CVE-2021-43054

The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any...

CVE-2021-43054 TIBCO eFTL Token Generation Vulnerability

The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any...

CVE-2021-43054

The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any...

TIBCO Security Advisory: January 11, 2022 - TIBCO eFTL -2021-43054

TIBCO eFTL Token Generation Vulnerability Original release date: January 11, 2022 Last revised:--- CVE-2021-43054 Source: TIBCO SoftwareInc. Products Affected TIBCO eFTL - Community Edition versions 6.7.2 and below TIBCO eFTL - Developer Edition versions 6.7.2 and below TIBCO eFTL - Enterprise...