100 matches found
GHSA-FJJW-82XW-VFC2 Apache ShenYu Admin has insecure permissions
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3. Version 2.5.0 contains a patch for this issue...
CVE-2022-37435
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3...
Design/Logic Flaw
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3...
CVE-2022-37435 Apache ShenYu Admin Improper Privilege Management
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3...
CVE-2022-37435 Apache ShenYu Admin Improper Privilege Management
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3...
CVE-2022-37435
CVE-2022-37435 concerns Apache ShenYu Admin insecure permissions that may let a low-privilege administrator modify a high-privilege administrator’s password, enabling privilege escalation. Affected versions: ShenYu Admin 2.4.2 and 2.4.3. Root cause, per multiple sources, is improper/unsafe permis...
Apache ShenYu Denial of Service Vulnerability
A denial-of-service vulnerability exists in Apache ShenYu, an asynchronous, high-performance, cross-language, responsive API gateway from the Apache Foundation, which stems from a failure to properly handle incoming error messages and can be exploited by attackers to pass in malicious regular...
Regular expression denial of service in Apache ShenYu
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...
CVE-2022-26650
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...
CVE-2022-26650 Apache ShenYu (incubating) Regular expression denial of service
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...
CVE-2022-26650 Apache ShenYu (incubating) Regular expression denial of service
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...
PT-2022-17983 · Apache · Apache Shenyu
Name of the Vulnerable Software and Affected Versions: Apache ShenYu incubating versions 2.4.0 through 2.4.2 Description: The issue arises from the use of Pattern.matches in RegexPredicateJudge.java, where both parameters are controllable by the user. This allows an attacker to pass in malicious...
Apache ShenYu 安全漏洞
A denial-of-service vulnerability exists in Apache ShenYu, an asynchronous, high-performance, cross-language, responsive API gateway from the Apache Foundation, which stems from a failure to properly handle incoming error messages and can be exploited by attackers to pass in malicious regular...
The vulnerability of the Apache ShenYu software lies in the insufficient protection of registration data, allowing attackers to obtain user registration data.
The vulnerability of the Apache ShenYu software is related to insufficient protection of registration data. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain user registration data through a specially crafted HTTP request...
The vulnerability of the Apache ShenYu software lies in the lack of authorization for critical functions, allowing attackers to circumvent established security restrictions.
The vulnerability of the Apache ShenYu software lies in the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to circumvent established security restrictions remotely...
The vulnerability of the Apache ShenYu software lies in the lack of authorization for critical functions, which allows attackers to circumvent established security restrictions.
The vulnerability of the Apache ShenYu software lies in the lack of authorization for critical functions. Exploiting this vulnerability allows a malicious actor to bypass established security restrictions and gain access to the /plugin API without being authorized...
The vulnerability of the Apache ShenYu software lies in its incorrect code generation management, allowing attackers to execute arbitrary code.
The vulnerability of the Apache ShenYu software is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using Groovy Code injection or SpEL injection...
GHSA-7RJP-FGWJ-47RW Missing authentication in ShenYu
Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1...
Password exposure in ShenYu
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later...