com.github.dblock.waffle:waffle-spring-security2 (>=1.7, <=1.7.5), com.googlecode.cedar-common:cedar-common-gae (>=2.1.3, <=5.8.4) +12 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (2.0.8.release)

org.springframework.security:spring-security-core MAVEN version 2.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security2 =1.7...

com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6), com.paddypowerbetfair.springframework:spring-security-saml-keys-rollover (1.0.2) +45 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.1.2.release)

org.springframework.security:spring-security-core MAVEN version 3.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security3 =1.5...

at.molindo.social:spring-social-security (1.1.0.release), cn.jhc:spring-social-qq (>=0.0.2, <=0.0.5) +128 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.2.3.release)

org.springframework.security:spring-security-core MAVEN version 3.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - at.molindo.social:spring-social-security 1.1.0.releas...

Spring Security and Spring Framework may not recognize certain paths that should be protected

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x as well as other unsupported versions rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms,...

com.github.btheu.settesting:spring (0.1.0), org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4) +10 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.2.2.release)

org.springframework.security:spring-security-core MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.btheu.settesting:spring 0.1.0 -...

com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta), com.logitags:cibet (>=1.1, <=1.9) +24 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.0.3.release)

org.springframework.security:spring-security-core MAVEN version 3.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.force.sdk:force-springsecurity =22.0.2-beta, =1.1...

com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +48 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.2.4.release)

org.springframework.security:spring-security-core MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

org.apache.camel:camel-example-spring-security (>=2.14.0, <=2.14.4), org.apache.camel:camel-spring-security (>=2.14.0, <=2.14.4) +27 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.1.7.release)

org.springframework.security:spring-security-core MAVEN version 3.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.camel:camel-example-spring-security =2.14....

com.cedac.spring.security:spring-security-mongodb (1.0.0), com.foreach.across.modules:admin-web-module (>=1.0.0.release, <=1.1.0.release) +127 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.2.7.release)

org.springframework.security:spring-security-core MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.cedac.spring.security:spring-security-mongodb 1.0...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +43 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (2.0.5.release)

org.springframework.security:spring-security-core MAVEN version 2.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.evasion:api =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0....

com.racquettrack:spring-security-oauth2-client (1.4), com.sitewhere:sitewhere-core (0.9.7) +40 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.1.1.release)

org.springframework.security:spring-security-core MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.racquettrack:spring-security-oauth2-client 1.4 -...

at.molindo.social:spring-social-security (1.1.4.release), com.foreach.across.modules:admin-web-module (1.1.1.release) +90 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.2.9.release)

org.springframework.security:spring-security-core MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - at.molindo.social:spring-social-security 1.1.4.releas...

org.codehaus.enunciate:enunciate-spring-security-rt (>=1.20, <=1.22), org.codehaus.spring-security-oauth:spring-security-oauth (>=2.4, <=3.19) +20 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (2.0.3)

org.springframework.security:spring-security-core MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.codehaus.enunciate:enunciate-spring-security-rt =1.20,...

org.apache.syncope:syncope-core (>=1.0.9, <=1.1.8), org.springframework.security:spring-security-acl (3.1.6.release) +11 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.1.6.release)

org.springframework.security:spring-security-core MAVEN version 3.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.syncope:syncope-core =1.0.9, =1.4.9, =1.4....

GHSA-CXRJ-66C5-9FMH Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...

Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...

Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

GHSA-V596-FWHQ-8X48 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

spring-security-oauth: remote code execution in the authorization process

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lea...

Privilege Escalation in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...