347 matches found
CVE-2019-10911
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/securit...
Laravel Sensitive Data Exposure
Laravel before 5.5.10 mishandles the rememberme token verification process because DatabaseUserProvider does not have constant-time token comparison...
GHSA-J5JH-HPR4-H332 Symfony Session Fixation Vulnerability
A session fixation vulnerability within the "Remember Me" login feature allows an attacker to impersonate the victim towards the web application if the session id value was previously known to the attacker. This issue has been fixed in Symfony 2.3.35, 2.6.12, and 2.7.7. Note that no fixes are...
Symfony Session Fixation Vulnerability
A session fixation vulnerability within the "Remember Me" login feature allows an attacker to impersonate the victim towards the web application if the session id value was previously known to the attacker. This issue has been fixed in Symfony 2.3.35, 2.6.12, and 2.7.7. Note that no fixes are...
GHSA-P836-389H-J692 Improper Access Control in Apache Shiro
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter...
GHSA-Q4CQ-R7HG-PXQQ Improper Authentication in Jenkins
A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled...
Improper Authorization in Jenkins Core
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g...
GHSA-6RH5-23HX-J452 Improper Authorization in Jenkins Core
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g...
CVE-2022-27225
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
CVE-2022-27225
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
CVE-2022-27225
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
Design/Logic Flaw
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
CVE-2022-27225
Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...
CVE-2022-24332
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
CVE-2022-24332
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
CVE-2022-24332
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
Design/Logic Flaw
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
CVE-2022-24332
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie...
CVE-2022-24332
The CVE-2022-24332 entry applies to JetBrains TeamCity prior to 2021.2, where the logout action did not remove the Remember Me cookie. This is documented in multiple sources (NVD/NVD lists the issue; Red Hat and CNVD references reiterate the same description). The JetBrains Security Bulletin Q4 2...
The vulnerability of the “Remember Me” function implementation in the Apache Shiro framework allows a hacker to execute arbitrary code or bypass security restrictions.
The vulnerability of the “Remember Me” function implementation in the Apache Shiro framework is related to the use of the default encryption key. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or bypass security restrictions remotely...