https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:53:05 +0000 https://db.gcve.eu/vuln/ghsa-c4qc-4q9p-m9q9 <p><strong>Affected:</strong> Maven: org.apache.shiro:shiro-core</p> <p>Observable Timing Discrepancy vulnerability in Apache Shiro.</p> <p>This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.</p> <p>Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.</p> <p>Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password.</p> <p>The most likely attack vector is a local attack only. Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.</p> <p>Typically, brute force attack can be mitigated at the infrastructure level.</p> <p><strong>Affected:</strong> Maven: org.apache.shiro:shiro-core</p> <p>Observable Timing Discrepancy vulnerability in Apache Shiro.</p> <p>This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.</p> <p>Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.</p> <p>Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password.</p> <p>The most likely attack vector is a local attack only. Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.</p> <p>Typically, brute force attack can be mitigated at the infrastructure level.</p> https://db.gcve.eu/vuln/ghsa-c4qc-4q9p-m9q9