WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product shiro-web✕
Overview 6 matches · 1 protected · 2 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
6matches 1protected16.7% 2exploited33.3% 0CISA KEV0.0% 1public PoC16.7% 1EPSS ≥ 0.516.7%
Protected by Waratek 1 16.7% Rule in development 0 0.0% Mitigation candidate 1 16.7% No exploit published 4 66.7% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 2 33.3% High 1 16.7% Medium 2 33.3% Low 1 16.7% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 16.7% partly blocked 0 0.0% not blocked 5 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 33.3% Working exploit published 0 0.0% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 3 50.0%
split by peak 2 / year
No exploit published: 4Mitigation candidate: 1Protected by Waratek: 1 Low: 1Medium: 2High: 1Critical: 2 not blocked: 5blocked by ARMR today: 1 No public exploit: 3Proof of concept only: 1Exploited: 2
20161 No exploit published1 High1 not blocked1 No public exploit1 20170 20180 20190 20200 20211 Mitigation candidate1 Critical1 not blocked1 Exploited1 20220 20232 Protected by Waratek1 No exploit published1 Critical1 Medium1 blocked by ARMR today1 not blocked1 Exploited1 Proof of concept only1 20240 20250 20262 No exploit published2 Medium1 Low1 not blocked2 No public exploit2
20162017201820192020202120222023202420252026
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-56130 Low 2026-06-25 No exploit published No public exploit "Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled. Upgrade to version 3.0.0 or later, which fixes the issue.
CVE-2026-43828 Medium 2026-05-25 No exploit published No public exploit Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
CVE-2023-46750 Medium 2023-12-14 No exploit published Proof of concept only URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
CVE-2023-34478 Critical 2023-07-24 Protected by Waratek Exploited Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+
CVE-2020-17523 Critical 2021-02-03 Mitigation candidate Exploited Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
CVE-2016-6802 High 2016-09-20 No exploit published No public exploit Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.