CVE-2023-48396 : APACHE SEATUNNEL WEB 1.0.0 APPLICATION.YML AUTHENTICATION SPOOFING

Description

Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version 1.0.1, which fixes the issue.

References

https://lists.apache.org/thread/1tdxfjksx0vb9gtyt77wlr6rdcy1qwmw

http://www.openwall.com/lists/oss-security/2024/07/30/1

For More Information

CVERecord

Contact us to get started

CVE-2024-8887 : CIRCUTOR Q-SMT 1.0.4 IMPROPER VALIDATION OF SPECIFIED QUANTITY IN INPUT

Description CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an

Learn more

CVE-2024-8762 : CODE-PROJECTS CRUD OPERATION SYSTEM 1.0 /UPDATEDATA.PHP SID SQL INJECTION

Description A vulnerability was found in code-projects Crud Operation System 1.0. It has been classified as critical. This affects an

Learn more

CVE-2024-34334 : ORDAT FOSS-ONLINE UP TO 2.24.00 FORGOT PASSWORD SQL INJECTION

Description ORDAT FOSS-Online before v2.24.01 was discovered to contain a SQL injection vulnerability via the forgot password function. References https://mind-bytes.de/sql-injection-in-foss-online-cve-2024-34334/

Learn more