Skip to content
Noroxi

CWE-1259 · 16 records

Improper Restriction of Security Token Assignment

CVEs in this class

16 records

  • CVE-2024-36533
    39Monitor

    Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's

    CriticalCVSS 9.8No exploitEPSS 0%

    Jul 24, 2024

  • CVE-2026-16716
    35Monitor

    Multiple Vulnerabilities in IBM API Connect

    HighCVSS 8.8No exploitEPSS 0%

    ibm · api connect2 days ago

  • CVE-2026-54593
    32Monitor

    Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

    HighCVSS 8.1No exploitEPSS 0%

    pterodactyl · panelJul 28, 2026

  • CVE-2026-76413
    32Monitor

    Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    cisco · cisco secure firewall management center (fmc)Sep 16, 2026

  • CVE-2024-29371
    30Monitor

    In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token wi

    HighCVSS 7.5No exploitEPSS 0%

    jose4j project · jose4jDec 17, 2025

  • CVE-2024-36111
    28Monitor

    KubePi's JWT token validation has a defect

    MediumCVSS 6.3No exploitEPSS 8%

    1panel-dev · kubepiJul 25, 2024

  • CVE-2026-25700
    28Monitor

    Apache Answer: AdminToken not invalidated after admin deactivation

    HighCVSS 7.2No exploitEPSS 0%

    apache · answerJun 10, 2026

  • CVE-2025-51306
    26Monitor

    In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without ex

    MediumCVSS 6.5No exploitEPSS 0%

    gatling · gatlingAug 6, 2025

  • CVE-2025-27955
    26Monitor

    Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote att

    MediumCVSS 6.5No exploitEPSS 0%

    philips · clinical collaboration platformJun 2, 2025

  • CVE-2024-4598
    26Monitor

    Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator

    MediumCVSS 6.5No exploitEPSS 0%

    wso2 · api managerSep 23, 2025

  • CVE-2025-56207
    26Monitor

    A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fu

    MediumCVSS 6.5No exploitEPSS 0%

    Sep 30, 2025

  • CVE-2024-45448
    22Monitor

    Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may a

    MediumCVSS 5.5No exploitEPSS 0%

    huawei · emuiSep 3, 2024

  • CVE-2025-50579
    21Monitor

    A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to

    MediumCVSS 5.3Proof of conceptEPSS 0%

    jc21 · nginx proxy managerAug 19, 2025

  • CVE-2025-56676
    21Monitor

    TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality.

    MediumCVSS 5.4No exploitEPSS 0%

    titansystems · zenderSep 30, 2025

  • CVE-2024-41948
    20Monitor

    biscuit-java vulnerable to public key confusion in third party block

    MediumCVSS 5.0No exploitEPSS 0%

    biscuitsec · biscuit-javaAug 1, 2024

  • CVE-2026-40264
    8Monitor

    OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

    LowCVSS 2.0No exploitEPSS 0%

    openbao · openbaoApr 20, 2026

All vulnerability classes