CVE-2021-37580

CVE-2021-37580 Apache ShenYu Admin Authentication Bypass...

CVE-2021-37580

CVE-2021-37580 POC for CVE-2021-37580 0x00 Vulnerability Principle Vulnerability principle: Apache ShenYu Admin bypass JWT authentication CVE-2021-37580 0x01 Single URL root@kitploit: Usage: python3 CVE-2021-37580.py -u url -n username.txt For shenyu-admin-2.4.0, vulnerable versions see below: Fo...

westone-CVE-2021-37580-scanner

westone-CVE-2021-37580-scanner Apache Shenyu es una solución de puerta de enlace API extensible, de alto rendimiento y responsiva aplicada a todos los escenarios de microservicios. Existe una vulnerabilidad de omisión de autenticación en Apache Shenyu admin. El uso inadecuado de JWT en el bootstr...

CVE-2021-37580

Apache ShenYu Admin爆出身份验证绕过漏洞，攻击者可通过该漏洞绕过JSON Web Token JWT安全认证，直接进入系统后台。 Apache ShenYu 是应用于所有微服务场景的，可扩展、高性能、响应式的 API 网关解决方案。 Apache ShenYu Admin 存在身份验证绕过漏洞。 ShenyuAdminBootstrap 中 JWT 的错误使用允许攻击者绕过身份验证，攻击者可通过该漏洞直接进入系统后台。 CVE 编号 CVE-2021-37580 fofa:fid="uPGDN6V9UWnc+KJdy5wdkQ==" 影响版本： Apache ShenY...

Apache ShenYu Admin JWT - Authentication Bypass

Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. id: CVE-2021-37580 info: name: Apache ShenYu Admin JWT - Authentication Bypass author: pdteam severity: critical descriptio...

Apache ShenYu Admin Unauth Access

Apache ShenYu suffers from an unauthorized access vulnerability where a user can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. id: CVE-2022-23944 info: name: Apache ShenYu Admin Unauth Access author: cckuakilong severity: critical description: Apach...

Apache-ShenYu-Admin-JWT-CVE-2021-37580-

此存储库没有 README。...

CVE-2023-25753

There exists an SSRF Server-Side Request Forgery vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability...

CVE-2022-23945

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2022-23223

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later...

CVE-2022-23944

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2022-26650

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matchesconditionData.getParamValue, realData to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource...

EUVD-2022-0510

Malicious code in bioql PyPI...

EUVD-2023-0797

Malicious code in bioql PyPI...

EUVD-2022-6799

Malicious code in bioql PyPI...

EUVD-2022-0603

Malicious code in bioql PyPI...

EUVD-2022-0505

Malicious code in bioql PyPI...

EUVD-2022-3643

Malicious code in bioql PyPI...

EUVD-2023-2691

Malicious code in bioql PyPI...

CVE-2022-42735

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch...