CWE-1259: Improper Restriction of Security Token Assignment
The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected, such as improperly restricting the assignment to trusted components.
A kind of CWE-1294 Insecure Security Identifier Mechanism.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.8 High
- gitea Gitea admin API public-only token scope bypass 6.5 Medium
- cisco secure firewall management center (fmc) Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability 8.2 High
- convoypanel panel Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions 8.1 High
- gitea open source git server Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints 4.9 Medium
- apache answer Apache Answer: AdminToken not invalidated after admin deactivation 7.2 High
- openbao OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation 2.0 Low
- titansystems zender TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset... 5.4 Medium
- No product listed A security flaw in the '_transfer' function of a smart contract implementation for Money Making... 6.5 Medium
- wso2 api manager, micro integrator +1 more Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator 6.5 Medium
- jc21 nginx proxy manager A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access... 5.3 Medium
- gatling In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token... 6.5 Medium
- philips clinical collaboration platform Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains... 6.5 Medium
- jose4j project jose4j jose4j is vulnerable to DoS via compressed JWE content 7.5 High
- huawei emui, harmonyos +1 more Page table protection configuration vulnerability in the trusted firmware module Impact:... 4.1 Medium
- biscuit-auth biscuit-java biscuit-java vulnerable to public key confusion in third party block 3.0 Low
- 1panel-dev kubepi KubePi's JWT token validation has a defect 6.3 Medium
- volcano Volcano has insecure permissions 9.8 Critical
- auth0 jsonwebtoken, node-jsonwebtoken +1 more jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC 5.0 Medium
- azure aad-pod-identity, microsoft azure ad pod identity +1 more AAD Pod Identity obtaining token with backslash 5.3 Medium