174 matches found
CVE-2024-43044-jenkins
Intro This is an exploit for CVE-2024-43044, an arbitrary file read that allows an agent to fetch files from the controller. The exploit will use the vulnerability to read files to forge a remember-me cookie for an admin account and gain access to Jenkins scripting engine. Check out the full...
CVE-2026-117619
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
EUVD-2026-112184
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
CVE-2026-117619
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
CVE-2026-117619
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
CVE-2026-117619
Jenkins versions 2.587 and earlier (including LTS 2.580.1 and earlier ) are vulnerable to an insufficient session expiration flaw (CVE-2026-117619 ). The root cause is that requests authenticated via HTTP Basic authentication , including those using API tokens , can result in the acquisition of a...
PT-2026-128307
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
CVE-2026-117619: Undefined Security Weakness
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...
Insufficient session expiration vulnerability
Jenkins's "Keep me signed in" feature uses a persistent cookie, known as the "remember me" cookie, to re-authenticate users without requiring them to enter credentials again. The validity of this cookie does not depend on the credentials used to obtain it. Jenkins 2.587 and earlier, LTS 2.580.1 a...
Jenkins security vulnerabilities
Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities arise because requests using HTTP Basic authentication—including those containing an API token—can result in the acquisition of a “remember me” cookie. As a consequence,...
CVE-2026-54631
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
CVE-2026-54631
The inventory management system Part-DB is vulnerable to session forgery in versions prior to 2.12.1 . The root cause is a hardcoded APP_SECRET (a03498528f5a5fc089273ec9ae5b2849) in the .env file, which is also present in the official jbtronics/part-db1 Docker image. Because Symfony uses this sec...
CVE-2026-54631 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
CVE-2026-54631 Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
EUVD-2026-108575
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APPSECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
PT-2026-121745
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP SECRET a03498528f5a5fc089273ec9ae5b2849. The official Docker image jbtronics/part-db1 does not override or...
CVE-2026-109313
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...
CVE-2026-109313
The Grav Login plugin (versions 2.7.0 before 3.9.9 ) is vulnerable to an authentication bypass (CWE-287). Attackers possessing a valid password can bypass two-factor authentication (2FA) by exploiting the remember-me cookie restoration mechanism. By obtaining a persistent remember-me cookie after...
EUVD-2026-97615
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as...