Apache ShenYu Admin JWT - Authentication Bypass

Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. id: CVE-2021-37580 info: name: Apache ShenYu Admin JWT - Authentication Bypass author: pdteam severity: critical descriptio...

CVE-2021-37580

Apache ShenYu Admin presenta una vulnerabilidad de evasión de autenticación; un atacante puede aprovecharla para eludir la autenticación segura de JSON Web Token JWT y acceder directamente al panel de administración del sistema. Apache ShenYu es una solución de puerta de enlace API escalable, de...

CVE-2021-37580

CVE-2021-37580 PoC de CVE-2021-37580 0x00 Principio de la vulnerabilidad Principio de la vulnerabilidad: Apache ShenYu Admin bypass JWT authentication CVE-2021-37580 0x01 URL individual Usage: python3 CVE-2021-37580.py -u url -n username.txt Para shenyu-admin-2.4.0, la versión vulnerable es la...

Apache ShenYu Admin Unauth Access

Apache ShenYu suffers from an unauthorized access vulnerability where a user can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. id: CVE-2022-23944 info: name: Apache ShenYu Admin Unauth Access author: cckuakilong severity: critical description: Apach...

CVE-2021-37580

CVE-2021-37580 Apache ShenYu Bypass de autenticación de administrador...

Apache-ShenYu-Admin-JWT-CVE-2021-37580-

Este repositorio no tiene un README...

westone-CVE-2021-37580-scanner

westone-CVE-2021-37580-scanner Apache Shenyu es una solución de puerta de enlace API extensible, de alto rendimiento y responsiva aplicada a todos los escenarios de microservicios. Existe una vulnerabilidad de omisión de autenticación en Apache Shenyu admin. El uso inadecuado de JWT en el bootstr...

CVE-2023-25753

There exists an SSRF Server-Side Request Forgery vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability...

CVE-2022-23945

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2022-23223

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later...

CVE-2022-23944

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2022-26650

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...

EUVD-2022-0510

Malicious code in bioql PyPI...

EUVD-2023-0797

Malicious code in bioql PyPI...

EUVD-2022-6799

Malicious code in bioql PyPI...

EUVD-2022-3643

Malicious code in bioql PyPI...

EUVD-2022-0603

Malicious code in bioql PyPI...

EUVD-2022-0505

Malicious code in bioql PyPI...

EUVD-2023-2691

Malicious code in bioql PyPI...

CVE-2022-42735

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch...