cn.bestwu:api-sign (>=1.0.0, <=1.0.1), cn.bestwu:security-oauth2-authorizationserver (1.0.0) +184 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.9.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.31.1, =3.1.1, =1.0.0.release, =0.1, =5.2.2, =1.2.0, =3.1.1, =0.1, =1.0.1.release, =1.0, =1.2.3 and more Source cves: CVE-2016-4977 Source advisory: GHSA-7Q9C-H23X-65FQ...

br.com.damsete.arq:damsete-arq (>=0.0.1, <=0.0.3), br.com.damsete.arq:damsete-arq-audit (>=0.0.1, <=0.0.3) +14 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.1.release, =4.0.0, =0.1.0, =4.26.0, =4.26.0, =3.3.0.6, =4.30.0 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

br.com.damsete.arq:damsete-arq (>=0.0.1, <=0.0.3), br.com.damsete.arq:damsete-arq-audit (>=0.0.1, <=0.0.3) +14 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.1.release, =4.0.0, =0.1.0, =4.26.0, =4.26.0, =3.3.0.6, =4.30.0 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

br.com.anteros:anteros-keycloak (1.0.0), com.blossom-project:blossom-starter-ui-api (>=1.0.0.m2, <=1.1.1) +47 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =1.0.6, =1.0.0, =0.7.4, =0.7.8 - com.vmware.card-connectors:airwatch-connector 2.1 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

com.ohadr.oauth2:auth-common (>=1.1.3, <=1.6.0-release), de.juplo:facebook-utils (1.0) +12 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.5.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.1.3, =1.0.1, =1.0.1, =1.0.1, =2.0.0, =1.3.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 - org.ozwillo.datacore:ozwillo-datacore-core 1.10.1 Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

com.ohadr.oauth2:auth-common (>=1.1.3, <=1.6.0-release), de.juplo:facebook-utils (1.0) +12 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.5.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.1.3, =1.0.1, =1.0.1, =1.0.1, =2.0.0, =1.3.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 - org.ozwillo.datacore:ozwillo-datacore-core 1.10.1 Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +639 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +639 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Qhttps://vulners.com/o...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Qhttps://vulners.com/githu...

br.com.anteros:anteros-keycloak (1.0.0), com.blossom-project:blossom-starter-ui-api (>=1.0.0.m2, <=1.1.1) +47 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =1.0.6, =1.0.0, =0.7.4, =0.7.8 - com.vmware.card-connectors:airwatch-connector 2.1 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

com.cedac.spring.security:spring-security-mongodb (1.0.0), com.foreach.across.modules:admin-web-module (>=1.0.0.release, <=1.1.0.release) +127 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.2.7.release)

org.springframework.security:spring-security-core MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.cedac.spring.security:spring-security-mongodb 1.0...

Privilege Escalation in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

FreeBSD : Gitlab -- multiple vulnerabilities (065b3b72-c5ab-11e8-9ae2-001b217b3468)

Gitlab reports : SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...

Gitlab -- multiple vulnerabilities

Gitlab reports: SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...

openSUSE Security Update : MozillaThunderbird (openSUSE-2018-994)

This update for MozillaThunderbird to version 60.0 fixes the following issues : These security issues were fixed : - CVE-2018-12359: Prevent buffer overflow using computed size of canvas element bsc1098998. - CVE-2018-12360: Prevent use-after-free when using focus bsc1098998. - CVE-2018-12361:...

Security update for MozillaThunderbird (important)

This update for MozillaThunderbird to version 60.0 fixes the following issues: These security issues were fixed: - CVE-2018-12359: Prevent buffer overflow using computed size of canvas element bsc1098998. - CVE-2018-12360: Prevent use-after-free when using focus bsc1098998. - CVE-2018-12361:...

Security update for nextcloud (moderate)

This update for nextcloud fixes the following issues: Security issues fixed: - CVE-2018-3761: Fix improper authentication on the OAuth2 token endpoint bsc1100344. - CVE-2018-3762: Fix improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it...

Authentication flaw

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised...

CVE-2018-3761

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised...