Common Weakness Enumeration

CWE-1259 Improper Restriction of Security Token Assignment

Description

The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-1259 ordered by modification date.

8 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-4gw2-vg4x-7p29	CVE-2026-25700	HIGH	golang/github.com/apache/answer golang/github.com/apache/incubator-answer	Apache Answer: AdminToken not invalidated after admin deactivation	2026-08-17
GHSA-8r6w-3qq5-4p4r	CVE-2026-54593	HIGH	golang/github.com/pterodactyl/wings	Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions	2026-07-28
GHSA-fq2p-5p22-8g6j	CVE-2026-58429	MODERATE	golang/code.gitea.io/gitea	Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints	2026-07-21
GHSA-p49j-v9wc-wg57	CVE-2026-40264	LOW	golang/github.com/openbao/openbao	OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation	2026-04-21
GHSA-3677-xxcr-wjqv	CVE-2024-29371	HIGH	maven/org.bitbucket.b_c/jose4j	jose4j is vulnerable to DoS via compressed JWE content	2026-01-06
GHSA-5hcj-rwm6-xmw4	CVE-2024-41948	MODERATE	maven/org.biscuitsec/biscuit	biscuit-java vulnerable to public key confusion in third party block	2024-11-18
GHSA-5g3x-8g2v-r8x8	CVE-2024-36533	CRITICAL	golang/github.com/volcano-sh/volcano golang/volcano.sh/volcano	Volcano has insecure permissions	2024-08-07
GHSA-hjrf-2m68-5959	CVE-2022-23541	MODERATE	npm/jsonwebtoken	jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC	2024-06-24