484 matches found
grafana: authentication bypass knowing only a username of an LDAP or OAuth user
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user...
Brave Software: Field Day With Protocol Handlers
Summary ===================== When launching a protocol such as mailto:, SEARCH:, or bitcoin:, Brave only asks to allow the protocol to be opened by an external application. You can select on whether or not to remember the decision or not and to allow or deny it. The issue is that upon selecting...
Citrix UPM + WEM - Google Chrome does not remember user login data
Google Chrome does not remember user login data with any website. Every time users launch Google Chrome in a new Desktop session, they have to type their username even after have enabled the Remember Me option...
FreeBSD : grafana -- LDAP and OAuth login vulnerability (1f8d5806-ac51-11e8-9cb6-10c37b4ac2ea)
Grafana Labs reports : On the 20th of August at 1800 CEST we were contacted about a potential security issue with the 'remember me' cookie Grafana sets upon login. The issue targeted users without a local Grafana password LDAP & OAuth users and enabled a potential attacker to generate a valid...
Grafana Authentication Bypass Vulnerability
Grafana is an open source, feature-rich metrics dashboard and graphical editor supporting Graphite, Elasticsearch, OpenTSDB, Prometheus, and InfluxDB. Grafana suffers from an authentication bypass vulnerability. The vulnerability stems from the fact that an attacker can generate a valid 'remember...
UBUNTU-CVE-2018-15727
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user...
CVE-2018-15727: Improper Authentication
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user...
PT-2018-3433 · Grafana +1 · Grafana +1
Name of the Vulnerable Software and Affected Versions: Grafana versions 2.x through 4.x before 4.6.4 Grafana versions 5.x before 5.2.3 Description: The issue is related to authentication errors in the Grafana web tool, allowing an attacker to bypass authentication. This can be achieved by...
CloudBees Jenkins Authorization Issues Vulnerability
CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...
grafana -- LDAP and OAuth login vulnerability
Grafana Labs reports: On the 20th of August at 1800 CEST we were contacted about a potential security issue with the “remember me” cookie Grafana sets upon login. The issue targeted users without a local Grafana password LDAP & OAuth users and enabled a potential attacker to generate a valid cook...
FreeBSD : jenkins -- multiple vulnerabilities (6905f05f-a0c9-11e8-8335-8c164535ad80)
Jenkins Security Advisory : DescriptionLow SECURITY-637 Jenkins allowed deserialization of URL objects with host components Medium SECURITY-672 Ephemeral user record was created on some invalid authentication attempts Medium SECURITY-790 Cron expression form validation could enter infinite loop,...
"Remember me" cookie was evaluated even if that feature is disabled
The "Remember me" feature can be disabled in the Jenkins security configuration. This did not disable the processing of previously set "Remember me" cookies, so they still allowed users to be logged in. "Remember me" cookies are no longer evaluated when the corresponding feature is disabled...
UBUNTU-CVE-2018-12934
rememberKtype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption aka OOM. This can occur during execution of cxxfilt...
Multiple Vulnerabilities in the Remember the News App
Remember the news app is a real-name authentication social software. There are arbitrary user registration and arbitrary user password reset vulnerabilities in JWAPP. An attacker can register any account and reset any password by grabbing packets and modifying them...
Laravel Security Bypass Vulnerability
Laravel is a PHP development framework for developing web applications and provides syntax highlighting, documentation and extension packages. A security vulnerability exists in Laravel versions prior to 5.5.10 that stems from the program failing to properly handle the rememberme token validation...
CVE-2017-14775
Laravel before 5.5.10 mishandles the rememberme token verification process because DatabaseUserProvider does not have constant-time token comparison...
shiro: Security constraint bypass
It was found that Apache Shiro uses a default cipher key for its "remember me" feature. An attacker could use this to devise a malicious request parameter and gain access to unauthorized content...
shiro: Security constraint bypass
It was found that Apache Shiro uses a default cipher key for its "remember me" feature. An attacker could use this to devise a malicious request parameter and gain access to unauthorized content...
Important: Red Hat Security Advisory: Red Hat JBoss A-MQ 6.3 security update
Red Hat JBoss A-MQ 6.3, which fixes multiple security issues and includes several bug fixes and enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...