170 matches found
CVE-2024-43044-jenkins
Intro This is an exploit for CVE-2024-43044, an arbitrary file read that allows an agent to fetch files from the controller. The exploit will use the vulnerability to read files to forge a remember-me cookie for an admin account and gain access to Jenkins scripting engine. Check out the full...
CVE-2026-117619
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
CVE-2026-117619
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
CVE-2026-117619
Jenkins versions 2.587 and earlier , and LTS 2.580.1 and earlier , are vulnerable to an issue where requests authenticated using HTTP Basic authentication (including those using an API token ) can obtain a "remember me" cookie. This allows an attacker who has acquired a user's API token to mainta...
EUVD-2026-112184
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
PT-2026-128307
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
CVE-2026-54631
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
CVE-2026-54631 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
CVE-2026-54631
The inventory management system Part-DB is vulnerable to session forgery in versions prior to 2.12.1 . The root cause is a hardcoded APP_SECRET (a03498528f5a5fc089273ec9ae5b2849) in the .env file, which is also present in the official jbtronics/part-db1 Docker image. Because Symfony uses this sec...
EUVD-2026-108575
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
CVE-2026-54631 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
PT-2026-121745
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP SECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
CVE-2026-109313
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
CVE-2026-109313
The Grav Login plugin (versions 2.7.0 before 3.9.9 ) is vulnerable to an authentication bypass (CWE-287). Attackers possessing a valid password can bypass two-factor authentication (2FA) by exploiting the remember-me cookie restoration mechanism. By obtaining a persistent remember-me cookie after...
EUVD-2026-97615
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
CVE-2026-109313
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
PT-2026-110730
Name of the Vulnerable Software and Affected Versions Grav Login plugin versions 2.7.0 through 3.9.8 Description An authentication bypass exists that allows attackers possessing a valid password to circumvent two-factor authentication. This is achieved through remember-me cookie restoration, wher...