Improper Input Validation

Overview shopware/platform is a Shopware e-commerce core. Affected versions of this package are vulnerable to Improper Input Validation via the password length. This is by submitting excessively long passwords through Storefront forms or Store-API. Remediation Upgrade shopware/platform to version...

Improper Input Validation

Overview shopware/core is a Shopware platform is the core for all Shopware ecommerce products. Affected versions of this package are vulnerable to Improper Input Validation via the password length. This is by submitting excessively long passwords through Storefront forms or Store-API. Remediation...

CVE-2025-30151 Shopware allows Denial Of Service via password length

Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.8.5 for Spring Boot security update.

Red Hat build of Apache Camel 4.8.5 for Spring Boot release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length

A flaw was found in the spring-security-core password encoder. This vulnerability allows incorrect password matching via input manipulation...

GHSA-MG83-C7GQ-RV5C Spring Security Does Not Enforce Password Length

BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same...

Spring Security Does Not Enforce Password Length

BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same...

CVE-2025-22228

BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same...

CVE-2025-22228 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same...

CVE-2025-22228

CVE-2025-22228 is reported in IBM Netcool Operations Insight. The issue arises from BCryptPasswordEncoder.matches(CharSequence,String) returning true for passwords longer than 72 characters if the first 72 characters are identical, enabling an authentication bypass under certain inputs. Affected ...

CVE-2025-22228 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same...

VMware Spring Security 安全漏洞

VMware Spring Security is a set of security frameworks from VMware, Inc. that provide illustrative security for Spring-based applications. A security vulnerability exists in VMware Spring Security that stems from incorrectly returning true for passwords longer than 72 characters...

Authentication Bypass by Primary Weakness

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the BCryptPasswordEncoder.matches function, which only takes the first 72 characte...

Spring Security BCryptPasswordEncoder does not enforce maximum password length

BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same...

BIT-PHP-MIN-2022-31626 mysqlnd/pdo password buffer overflow

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can...

CVE-2024-55548

Improper check of password character lenght in ORing IAP-420 allows a forced deadlock. This issue affects IAP-420: through 2.01e...

CVE-2024-55548

CVE-2024-55548 concerns the ORing IAP-420 wireless access point. The vulnerability stems from an improper check of password character length in the ORing operation, reported to affect versions through 2.01e. The resulting condition can cause a forced deadlock. Multiple sources corroborate this is...

ORing IAP-420 安全漏洞

The ORing IAP-420 is a wireless access point from ORing. A security vulnerability exists in the ORing IAP-420 version 2.01e and prior versions, which stems from a forced deadlock caused by improper password character length checking...

PT-2024-36548 · Iap-420 · Iap-420

Name of the Vulnerable Software and Affected Versions: IAP-420 versions through 2.01e Description: The issue is related to an improper check of password character length in the ORing operation of IAP-420, allowing a forced deadlock. Recommendations: For versions through 2.01e, update to a version...

NIST Recommends Some Common-Sense Password Rules

NIST's second draft of its "SP 800-63-4"--its digital identify guidelines--finally contains some really good rules about passwords: The following requirements apply to passwords: 1. lVerifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require...