shisoserial

shisoserial English Document Что это? Быстрый инструмент для эксплуатации уязвимости десериализации Shiro CVE-2016-4437 Участники 4nth0ny @Лаборатория пятницы Принимаются issues/PR : Окружение python 3.x JDK 1.8 Установка python3 -m pip install -r requirements.txt для AttributeError: module...

CVE-2026-49268

The CVE-2026-49268 issue affects Apache Shiro’s DefaultLdapRealm where user input is concatenated into the LDAP DN template without escaping RFC 2253 characters. This LDAP DN injection can alter the bind DN, potentially bypassing authentication or impersonating other users. Technical details conf...

CVE-2026-49268 Apache Shiro: LDAP DN Injection in DefaultLdapRealm

A remote attacker can inject LDAP special characters into the Distinguished Name DN construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate th...

EUVD-2026-37701

A remote attacker can inject LDAP special characters into the Distinguished Name DN construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate th...

EUVD-2021-24699

Malware in sbrugna...

CVE-2021-38241

Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework...

Improper Access Control

org.opendaylight.sfc:sfc-parent is vulnerable to Improper Access Control. The vulnerability is due to flaws in the Shiro-based RBAC mechanism due to improper enforcement of role-based access control, allowing attackers to execute privileged operations via crafted requests...

Deyue Remote Vehicle Management System Code Issue Vulnerability

Deyue Remote Vehicle Management System is a remote vehicle management system. A code issue vulnerability exists in Deyue Remote Vehicle Management System v1.1, which stems from the use of the Shiro framework, which uses a default key that can be deserialized using Shiro to gain system privileges...

CVE-2021-38241

Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework...

Deserialization of untrusted data

Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework...

CVE-2021-38241: Deserialization of Untrusted Data

Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework...

CVE-2021-38241

Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework...

PT-2022-10701

Name of the Vulnerable Software and Affected Versions Ruoyi versions prior to 4.6.1 Description A deserialization issue was discovered, allowing remote attackers to run arbitrary code via a weak cipher in the Shiro framework. Recommendations For versions prior to 4.6.1, update to version 4.6.1 or...

Shiro-721

This is a vulnerability analysis of a Shiro RCE Remote Code Execution exploit via Padding Oracle Attack. Here's a summary of the key points: Vulnerability Overview The Shiro framework is a popular open-source security framework that provides identity, authentication, authorization, encryption, an...