CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 5 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Apache ShenYu (incubating) Regular expression denial of service

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.

CWE-1333CWE-862May 17, 2022
CVSS7.5v3.1EPSS2.56%PoCs0SignalsSTIX

Apache ShenYu missing authentication allows gateway registration

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CWE-306CWE-862Jan 25, 2022
CVSS7.5v3.1EPSS3.77%PoCs0SignalsSTIX

Apache ShenYu 2.4.1 Improper access control

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CWE-306CWE-862Jan 25, 20221 related artifact
CVSS9.1v3.1EPSS79%PoCs0SignalsSTIX

Apache ShenYu Password leakage

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

CWE-522Jan 25, 2022
CVSS7.5v3.1EPSS4.31%PoCs0SignalsSTIX

Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CWE-94Jan 25, 2022
CVSS9.8v3.1EPSS6.03%PoCs0SignalsSTIX