Show filters
6 Total Results
Displaying 1-6 of 6
Sort by:
Attacker Value
Unknown
CVE-2022-26650
Disclosure Date: May 17, 2022 (last updated October 07, 2023)
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.
0
Attacker Value
Unknown
CVE-2022-23945
Disclosure Date: January 25, 2022 (last updated February 23, 2025)
Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
0
Attacker Value
Unknown
CVE-2022-23944
Disclosure Date: January 25, 2022 (last updated February 23, 2025)
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
0
Attacker Value
Unknown
CVE-2022-23223
Disclosure Date: January 25, 2022 (last updated February 23, 2025)
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
0
Attacker Value
Unknown
CVE-2021-45029
Disclosure Date: January 25, 2022 (last updated February 23, 2025)
Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
0
Attacker Value
Unknown
CVE-2021-37580
Disclosure Date: November 16, 2021 (last updated February 23, 2025)
A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0
0
