Improper Access Control in Apache Shiro

Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path...

GHSA-3JX9-MGWX-4Q83 Apache Shiro Path Traversal vulnerability

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI...

Apache Shiro Path Traversal vulnerability

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI...

Apache Shiro HTTP Detection

Binary data apacheshirohttpdetect.nbin...

Apache Shiro < 1.2.5 Default Cipher Key (CVE-2016-4437)

The Apache Shiro uses a default cipher key for the 'remember me' feature when not explicitly configured. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code or access content that would otherwise be protected by a security constraint...

CVE-2020-19229

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter...

CVE-2020-19229

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter...

Deserialization of untrusted data

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter...

CVE-2020-19229

CVE-2020-19229 affects Jeesite 1.2.7 which bundles Apache Shiro 1.2.3. The issue arises from a Java deserialization vulnerability via the rememberMe parameter when a cipher key is not configured, enabling remote code execution. Public details indicate the root cause is CVE-2016-4437 (Apache Shiro...

CVE-2020-19229

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter. Recent assessments: Assessed Attacker Value: 0...

Apache Shiro Default Cipher Key (CVE-2016-4437)

Binary data apacheshirocve-2016-4437.nbin...

Apache Shiro JAR Detection

Binary data shirojardetection.nbin...

GHSA-V98J-7CRC-WVRJ Authentication bypass in Apache Shiro

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...

Authentication bypass in Apache Shiro

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...

MingSoft Mcms Trust Management Issue Vulnerability

MingSoft Mcms is a complete open source J2ee system from MingSoft, China. v5.2.4 of MingSoft Mcms contains a security vulnerability that stems from the existence of a hard-coded shiro-key in the software, which can be exploited by attackers to execute arbitrary code...

CVE-2022-22928

MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code...

CVE-2022-22928

MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code...

CVE-2022-22928

MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code...

Hardcoded credentials

MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code...

MingSoft Mcms 信任管理问题漏洞

MingSoft Mcms is a complete open source J2ee system from MingSoft, China. v5.2.4 of MingSoft Mcms contains a security vulnerability that stems from the existence of a hard-coded shiro-key in the software, which can be exploited by attackers to execute arbitrary code...