apache aurora vulnerabilities

Latest apache aurora CVEs

Newest publication first

1. CVE-2024-27905 Apache Aurora: padding oracle can allow construction an authentication cookie

   Published 2024-02-27

   Critical·CVSS 9.1

   ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication...

2. CVE-2016-4437 Improper Access Control in Apache Shiro

   Published 2016-06-07

   Critical·CVSS 9.8 EPSS 93.0% CISA KEV added 2021-11-03 Exploited in the wild Framework module Public exploit PoC

   Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.