Most recent entries from all

bdu:2019-04890

cnvd-2019-42574

EUVD-2026-55000

fkie_cve-2019-12422

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

GHSA-r679-m633-g7wc — Improper input validation in Apache Shiro

Affected: Maven: org.apache.shiro:shiro-core

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

gsd-2019-12422

RHSA-2020:0983 — Red Hat Security Advisory: Red Hat Fuse 7.6.0 security update

jquery: Cross-site scripting via cross-domain ajax requests logback: Serialization vulnerability in SocketServer and ServerSocketReceiver js-jquery: XSS in responses from cross-origin ajax requests apache-commons-compress: ZipArchiveInputStream.read() fails to identify correct EOF allowing for DoS via crafted zip jetty: full server path revealed when using the default Error Handling springframework: DoS Attack via Range Requests spring-data-api: potential information disclosure through maliciously crafted example value in ExampleMatcher undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed c3p0: loading XML configuration leads to denial of service HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using PRIORITY frames results in excessive resource consumption HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth HTTP/2: 0-length headers lead to denial of service HTTP/2: request for large response leads to denial of service HTTP/2: flood using empty frames results in excessive resource consumption infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods undertow: Information leak in requests for directories without trailing slashes jetty: using specially formatted URL against DefaultServlet or ResourceHandler leads to XSS conditions jetty: error path information disclosure spring-secur…

UBUNTU-CVE-2019-12422

Affected: Ubuntu:Pro:16.04:LTS: shiro, Ubuntu:Pro:18.04:LTS: shiro, Ubuntu:20.04:LTS: shiro, Ubuntu:22.04:LTS: shiro, Ubuntu:24.04:LTS: shiro

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.