spring-security-oauth: remote code execution in the authorization process

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lea...

RCE with spring-security-oauth2 分析(CVE-2018-1260)

漏洞公告 环境搭建 利用github上已有的demo： git clone https://github.com/wanghongfei/spring-security-oauth2-example.git 确保导入的spring-security-oauth2为受影响版本，以这里为例为2.0.10 进入spring-security-oauth2-example，修改 cn/com/sina/alan/oauth/config/OAuthSecurityConfig.java的第67行: @Override public void...

CVE-2015-8466

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

CVE-2015-8466

CVE-2015-8466 affects OpenStack Swift3 (S3 compatibility) middleware, allowing a remote replay attack when an Authorization request lacks a Date header. The issue is in Swift3 by default up to version 1.9. Public fixes are available in upstream Swift3 release 1.9. Debian lists fixed packages 1.7-...

CVE-2015-8466

Removed by vendor...

&RQ buffer overflow

Authorization request buffer overflow...

SureCom EP-9510AXEP-4504AX Network Device - Malformed Web Authorisation Request Denial of Service (1)

SureCom EP-9510AXEP-4504AX Network Device - Malformed Web Authorisation Request Denial of Service 1 source: https://www.securityfocus.com/bid/9795/info An issue in the handling of specific web requests by SureCom network devices has been identified. By placing a malformed request to the web...