ROOT-APP-MAVEN-CVE-2022-22978 CVE-2022-22978 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2022-22978 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8)

The version of AOS installed on the remote host is prior to 6.8. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8 advisory. - In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be...

Security Bulletin: Vulnerability in Spring Security affects IBM Process Mining . CVE-2022-22978

Summary There is a vulnerability in Spring Security that could allow an remote attacker to bypass security restrictions and obtain access to the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...

Important: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Exploit for Incorrect Authorization in Vmware Spring_Security

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher...

Security Bulletin: IBM Sterling B2B Integrator vulnerable to security bypass due to Spring Security (CVE-2022-31692, CVE-2022-22978)

Summary IBM Sterling B2B Integrator has addressed the security vulnerabilities in Spring Security Vulnerability Details CVEID:CVE-2022-31692 DESCRIPTION: VMware Tanzu Spring Security could allow a remote attacker to bypass security restrictions, caused by a flaw when using forward or include...

Exploit for Incorrect Authorization in Vmware Spring_Security

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher...

Security Bulletin: Vulnerabilities in Spring Framework affects IBM Common Licensing's Administration And Reporting Tool (ART) and its Agent (CVE-2022-22978, 220811)

Summary Security Vulnerablities have been addressed in IBM Common Licensing. In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. A fix is available to address the vulnerability...

Exploit for Incorrect Authorization in Vmware Spring_Security

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher...

Exploit for Incorrect Authorization in Vmware Spring_Security

CVE-2022-22978 Spring-Security Bypass Demo When using Rege...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.4, <=3.0.1), br.net.woodstock.rockframework:rockframework-persistence (>=2.0.0, <=2.0.8) +23 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.0.6.release)

org.springframework.security:spring-security-core MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - br.net.woodstock.rockframework:rockframework-domain...

co.paralleluniverse:comsat-spring-boot-security (0.7.0), co.paralleluniverse:comsat-spring-security (0.7.0) +226 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.0.4.release)

org.springframework.security:spring-security-web MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - co.paralleluniverse:comsat-spring-boot-security 0.7.0 -...

co.paralleluniverse:comsat-spring-security (0.3.0), com.bq.corbel:oauth-server (>=1.31.1, <=1.35.0) +289 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.2.5.release)

org.springframework.security:spring-security-core MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - co.paralleluniverse:comsat-spring-security 0.3.0 -...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +71 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.1.4.release)

org.springframework.security:spring-security-web MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =3.0.1.3,...

com.ahome-it:ahome-tooling-server-core (>=1.1.5-release, <=1.1.9-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.5-release, <=1.1.9-release) +54 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.1.2.release)

org.springframework.security:spring-security-web MAVEN version 4.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.5-release,...

com.capitalone.dashboard:api (>=3.3.0, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.5.1, <=3.7.33) +71 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.18.release)

org.springframework.security:spring-security-web MAVEN version 4.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.capitalone.dashboard:api =3.3.0, =3.5.1, =3.2.0,...

com.ge.predix:uaa-token-lib (>=3.3.2, <=4.0.1), com.github.lizixiang:triph-common (0.0.1-release) +96 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.2.10.release)

org.springframework.security:spring-security-web MAVEN version 3.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.ge.predix:uaa-token-lib =3.3.2, =1.0.6, =1.0.1,...

com.github.waffle.demo:waffle-spring-filter (3.0.0), com.github.waffle.demo:waffle-spring-form (3.0.0) +23 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.19.release)

org.springframework.security:spring-security-web MAVEN version 4.2.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.waffle.demo:waffle-spring-filter 3.0.0 -...

org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4), org.springframework.security:spring-security-cas (3.2.2.release) +3 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.2.2.release)

org.springframework.security:spring-security-web MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.pac4j:spring-security-pac4j =1.2.3, =1.2.4 -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.11), ch.sharedvd.tipi:tipi-engine (>=1.1.10, <=1.1.11) +138 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.7.release)

org.springframework.security:spring-security-web MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter...