Weakness (CWE)
CWE-1259: Improper Restriction of Security Token Assignment
The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected, such as improperly restricting the assignment to trusted components.
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation
Since the Security Tokens are integral for the maintenance of security in an SoC, they need to be protected properly.
- Security Token assignment review checks for design inconsistency and common weaknesses.
- Security-Token definition and programming flow is tested in both pre-silicon and post-silicon testing.
Source: MITRE CWE-1259
19 results · Feed
-
Medium 6.5
Gitea admin API public-only token scope bypass
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, creat…
-
High 8.2
Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability
A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper m…
-
Medium 4.9
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
-
High 8.1
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without ch…
-
High 7.2
Apache Answer: AdminToken not invalidated after admin deactivation
Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivat…
-
Low 2.0
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in anoth…
-
High 7.5
jose4j is vulnerable to DoS via compressed JWE content
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memor…
-
Medium 5.4
TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary …
-
Medium 6.5
A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an E…
-
Medium 6.5
Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator
An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not pr…
-
Medium 5.3CVE-2025-50579 Public exploit
A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particular…
-
Medium 6.5
In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the a…
-
Medium 6.5
Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout an…
-
Medium 4.1
Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of thi…
-
Low 3.0
biscuit-java vulnerable to public key confusion in third party block
biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock re…
-
Medium 6.3
KubePi's JWT token validation has a defect
KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key…
-
Critical 9.8
Volcano has insecure permissions
Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
-
Medium 5.0
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result…
-
Medium 5.3
AAD Pod Identity obtaining token with backslash
aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token reques…