Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
shiro vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2023-34478
Apache Shiro, prior to 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.1...
Apache Shiro 2.0.0
Apache Shiro
NA
CVE-2023-46749
Apache Shiro prior to 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this i...
Apache Shiro 2.0.0
Apache Shiro
NA
CVE-2023-46750
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
Apache Shiro 2.0.0
Apache Shiro
9
CVSSv2
CVE-2020-17523
Apache Shiro prior to 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Apache Shiro
4 Github repositories
7.5
CVSSv2
CVE-2020-11989
Apache Shiro prior to 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Apache Shiro
2 Github repositories
7.5
CVSSv2
CVE-2022-32532
Apache Shiro prior to 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Apache Shiro
3 Github repositories
5
CVSSv2
CVE-2019-12422
Apache Shiro prior to 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
Apache Shiro
NA
CVE-2022-40664
Apache Shiro prior to 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
Apache Shiro
5
CVSSv2
CVE-2018-20437
An issue exists in the fileDownload function in the CommonController class in FEBS-Shiro prior to 2018-11-05. An attacker can download a file via a request of the form /common/download?filename=1.jsp&delete=false. NOTE: the software maintainer disputes the significance of thi...
Mrbird Febs-shiro
NA
CVE-2024-0356
A vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file updateRoles of the component Backend. The manipulation leads to improper access controls. The exploit has been disclo...
Mandelo Ssm Shiro Blog 1.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-37316
firmware
CVE-2024-30078
CVE-2024-5995
remote code execution
logic flaw
CVE-2024-20693
CVE-2024-37315
CVE-2024-5464
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »