14 matches found
Awesome_shiro
Awesome-shiro CVE-2016-4437 Shiro Base64 decode -- AES decrypt -- Deserialize Environment Works on both linux/win10 Works on both python2/python3 Since the module directory contains ysoserial.jar, the project is a bit large. Please bear with us. Local Target Setup...
CVE-2016-4437
shiro-1.2.4 Vulnerability Tool Decrypt rememberMe value and export corresponding class file Usage xk-mt-rememberMe解码.py Instructions: After running, first enter the key or press Enter to use the default key 'kPH+bIxk5D2deZiIxcaaaA==', then enter the rememberMe value from the request packet. After...
CVE-2024-51996
⚠️ CVE-2024-51996 - Symfony RememberMe Auth Bypass Exploit Exploit for the critical vulnerability CVE-2024-51996 , which allows authentication bypass in Symfony applications that use the Remember Me mechanism. 🧠 Impact : Impersonation of privileged users such as admin without the need for valid...
SHIRO-721
SHIRO-721 RememberMe Padding Oracle Vulnerability RCE 0x00 Introduction: The RememberMe cookie is encrypted using AES-128-CBC mode, which is vulnerable to padding oracle attacks. An attacker can use a valid RememberMe cookie as a prefix for a Padding Oracle Attack, and then craft a malicious...
CVE-2026-56130
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only whe...
CVE-2026-43828
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected...
CVE-2026-43828
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected...
Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora
Awesome-shiro CVE-2016-4437 Shiro=1.2.4反序列化，爆破模块和key、代码执行、反弹shell的工具 ---- 漏洞原因 因为shiro对cookie里的rememberme字段进行了反序列化，所以如果知道了shiro的编码方式，然后将恶意命令用它的编码方式进行编码并放在http头的cookie里，在shiro对提交的cookie的rememberme字段进行反序列化时，也就执行了插入的命令，最终造成了命令执行 shiro默认使用了CookieRememberMeManager，其处理cookie的流程是：...
Authentication Bypass
scheb/two-factor-bundle is vulnerable to authentication bypass. The 2-factor authentication can be bypassed by logging in with the REMEMBERME cookie and subsequently removing the SESSIONID key...
Apache shiro 1.2.4 version of remote command execution vulnerability details-vulnerability warning-the black bar safety net
Search, I found online about apache shiro 1.2.4 version of the vulnerability consolidation report to write too simple, is perhaps the bigwigs speaking of professional, I this noob can't read the reason, specially in the local do a full show. First from the shiro official get shiro 1.2.4 of the...
rememberme cookie is not cleared when user changes password in Confluence
When a user changes their password, the seraph cookie is still valid. To avoid this, all entries for the changed user in the table remembermetoken should be removed...
rememberme cookie is not cleared when user changes password in Confluence
When a user changes their password, the seraph cookie is still valid. To avoid this, all entries for the changed user in the table remembermetoken should be removed...
