WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product shiro✕
Overview 12 matches · 7 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
12matches 7in Waratek scope58.3% 0protected0.0% 1exploited8.3% 0CISA KEV0.0% 1public PoC8.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 8.3% No exploit published 6 50.0% Outside Waratek scope 0 0.0% Not applicable 5 41.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 12 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 12 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 8.3% Working exploit published 0 0.0% Proof of concept only 2 16.7% Forecast only 0 0.0% No public exploit 9 75.0%
split by peak 2 / year
Not applicable: 5No exploit published: 6Mitigation candidate: 1 High: 12 not blocked: 12 No public exploit: 9Proof of concept only: 2Exploited: 1
20142 No exploit published1 Not applicable1 High2 not blocked2 Exploited1 No public exploit1 20150 20161 No exploit published1 High1 not blocked1 No public exploit1 20170 20181 Not applicable1 High1 not blocked1 No public exploit1 20191 No exploit published1 High1 not blocked1 No public exploit1 20201 Mitigation candidate1 High1 not blocked1 Proof of concept only1 20210 20220 20232 No exploit published1 Not applicable1 High2 not blocked2 No public exploit2 20241 Not applicable1 High1 not blocked1 Proof of concept only1 20251 Not applicable1 High1 not blocked1 No public exploit1 20262 No exploit published2 High2 not blocked2 No public exploit2
2014201620182020202220242026
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-56091 High 2026-06-25 No exploit published No public exploit When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module. This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context. Upgrade to version 3.0.0 or later, which fixes the issue.
CVE-2026-49268 High 2026-06-17 No exploit published No public exploit A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
CVE-2025-45613 High 2025-05-05 Not applicable No public exploit Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload.
CVE-2024-0356 High 2024-01-10 Not applicable Proof of concept only A vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file updateRoles of the component Backend. The manipulation leads to improper access controls. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250123.
CVE-2023-22362 High 2023-02-13 Not applicable No public exploit SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Affected products/versions are as follows: SUSHIRO Ver.4.0.31, Thailand SUSHIRO Ver.1.0.0, Hong Kong SUSHIRO Ver.3.0.2, Singapore SUSHIRO Ver.2.0.0, and Taiwan SUSHIRO Ver.2.0.1
CVE-2023-22602 High 2023-01-14 No exploit published No public exploit When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`
CVE-2020-13933 High 2020-08-17 Mitigation candidate Proof of concept only Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.
CVE-2019-12422 High 2019-11-18 No exploit published No public exploit Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
CVE-2018-20437 High 2018-12-25 Not applicable No public exploit An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An attacker can download a file via a request of the form /common/download?filename=1.jsp&delete=false. NOTE: the software maintainer disputes the significance of this report because the product uses a JAR archive for deployment, and this contains application.yml with configuration data
CVE-2016-6802 High 2016-09-20 No exploit published No public exploit Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
CVE-2014-0074 High 2014-10-06 No exploit published No public exploit Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
CVE-2014-0810 High 2014-01-29 Not applicable Exploited Unspecified vulnerability in JustSystems Sanshiro 2007 before update 3, 2008 before update 5, 2009 before update 6, and 2010 before update 6, and Sanshiro Viewer before 2.0.2.0, allows remote attackers to execute arbitrary code via a crafted document.