In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...
7.5CVSS
7.3AI Score
0.001EPSS
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or...
7.5CVSS
7.4AI Score
0.002EPSS
Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and...
7.5CVSS
7.6AI Score
0.004EPSS
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and...
9.1CVSS
9.1AI Score
0.246EPSS
Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and...
9.8CVSS
9.7AI Score
0.014EPSS