CWE-1270: Generation of Incorrect Security Tokens
The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
A kind of CWE-1294 Insecure Security Identifier Mechanism.
From the CWE List. © The MITRE Corporation.
Newest
- tenable security center Insuffucient Protections Lead to Brute Force 6.0 Medium
- gitlab Generation of Incorrect Security Tokens in GitLab 4.3 Medium
- convoypanel panel Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions 8.1 High
- dell powerprotect data manager Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect... 8.8 High
- entrust nshield 5c firmware, nshield connect xc base firmware, nshield connect xc high firmware +2 more +4 more Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, might allow a... 6.8 Medium
- neuvector JWT token compromise can allow malicious actions including Remote Code Execution (RCE) 9.4 Critical
- suse neuvector, manager server +1 more JWT token compromise can allow malicious actions including Remote Code Execution (RCE) 9.4 Critical
- cbot core, panel, chatbot +2 more Privilege Escalation in CBOT's Chatbot 9.8 Critical
- jenkins report portal, jenkins project report portal plugin +1 more Jenkins Report Portal Plugin configuration form does not mask tokens 4.3 Medium
- wire server, wireapp wire-server +1 more Wire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creation 9.8 Critical
- openstack keystone OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend 5.0 Medium