14 matches found
CVE-2024-51996
⚠️ CVE-2024-51996 - Symfony RememberMe Auth Bypass Exploit Exploit für die kritische Schwachstelle CVE-2024-51996 , die den Authentifizierungs-Bypass in Symfony-Anwendungen ermöglicht, die den Remember Me-Mechanismus verwenden. 🧠 Auswirkung : Identitätswechsel privilegierter Benutzer wie admin ohn...
CVE-2016-4437
shiro-1.2.4 - Strumento per vulnerabilità Decodifica il valore rememberMe ed esporta il corrispondente file class. Modalità d'uso xk-mt-rememberMe解码.py Spiegazione dell'esecuzione: Dopo l'esecuzione, inserisci la chiave o premi Invio per usare la chiave predefinita 'kPH+bIxk5D2deZiIxcaaaA=='...
Awesome_shiro
Awesome-shiro CVE-2016-4437 Shiro Base64-Dekodierung -- AES-Entschlüsselung -- Deserialisierung Umgebung Linux/Windows 10 werden unterstützt Python2/Python3 werden unterstützt Da sich unter module die ysoserial.jar befindet, ist das Projekt etwas größer; bitte um Nachsicht. Lokales Einrichten der...
SHIRO-721
SHIRO-721 RememberMe Padding Oracle Vulnerability RCE 0x00 Einführung： Das RememberMe des Cookies wird im AES-128-CBC-Modus verschlüsselt, sodass es anfällig für Padding-Oracle-Angriffe ist. Ein Angreifer kann ein gültiges RememberMe-Cookie als Präfix für einen Padding-Oracle-Angriff verwenden un...
CVE-2026-56130
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only whe...
CVE-2026-43828
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected...
CVE-2026-43828
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected...
Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora
Awesome-shiro CVE-2016-4437 Shiro=1.2.4反序列化，爆破模块和key、代码执行、反弹shell的工具 ---- 漏洞原因 因为shiro对cookie里的rememberme字段进行了反序列化，所以如果知道了shiro的编码方式，然后将恶意命令用它的编码方式进行编码并放在http头的cookie里，在shiro对提交的cookie的rememberme字段进行反序列化时，也就执行了插入的命令，最终造成了命令执行 shiro默认使用了CookieRememberMeManager，其处理cookie的流程是：...
Authentication Bypass
scheb/two-factor-bundle is vulnerable to authentication bypass. The 2-factor authentication can be bypassed by logging in with the REMEMBERME cookie and subsequently removing the SESSIONID key...
Apache shiro 1.2.4 version of remote command execution vulnerability details-vulnerability warning-the black bar safety net
Search, I found online about apache shiro 1.2.4 version of the vulnerability consolidation report to write too simple, is perhaps the bigwigs speaking of professional, I this noob can't read the reason, specially in the local do a full show. First from the shiro official get shiro 1.2.4 of the...
rememberme cookie is not cleared when user changes password in Confluence
When a user changes their password, the seraph cookie is still valid. To avoid this, all entries for the changed user in the table remembermetoken should be removed...
rememberme cookie is not cleared when user changes password in Confluence
When a user changes their password, the seraph cookie is still valid. To avoid this, all entries for the changed user in the table remembermetoken should be removed...
