Security Bulletin: IBM Spectrum Symphony with spring-security-config is vulnerable to Incorrect Permission Assignment for Critical Resource

Summary IBM Spectrum Symphony with spring-security-config is vulnerable to Incorrect Permission Assignment for Critical Resource Vulnerability Details CVEID:CVE-2023-34042 DESCRIPTION: VMware Tanzu Spring Security could allow a local authenticated attacker to bypass security restrictions, caused ...

Security Bulletin: IBM Spectrum Conductor with spring-security-config is vulnerable to Incorrect Permission Assignment for Critical Resource

Summary IBM Spectrum Conductor with spring-security-config is vulnerable to Incorrect Permission Assignment for Critical Resource Vulnerability Details CVEID:CVE-2023-34042 DESCRIPTION: VMware Tanzu Spring Security could allow a local authenticated attacker to bypass security restrictions, caused...

org.springframework.security:spring-security-core Dependency in Bamboo Data Center and Server

This High severity org.springframework.security:spring-security-core Dependency vulnerability was introduced in versions 8.2.1, 9.0.0, 9.1.0, 9.2.1, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This org.springframework.security:spring-security-core Dependency vulnerability, wi...

Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities

Summary QRadar Suite Software includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version. Vulnerability Details...

Improper Authorization org.springframework.security:spring-security-core Dependency in Crowd Data Center and Server

This High severity org.springframework.security:spring-security-core Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.0 of Crowd Data Center and Server. This org.springframework.security:spring-security-core Dependency vulnerability, with a CVSS Score of 8.2 and a CVSS...

PKCE Downgrade Attack

spring-security-oauth2-authorization-server is vulnerable to PKCE Downgrade. The vulnerability is due to improper handling of PKCE authorization when a Confidential Client requests an Authorization Code Grant. Note that this vulnerability only applies to Confidential Clients, Public Clients are...

cn.com.tltim.pigx:pigx-common-security (5.0.0-20240820), cn.com.tltim.pigx:pigx-common-websocket (5.0.0-20240820) +8 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.4.4)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authorization (>=2.7.0.beta4, <=2.7.0.10), cn.herodotus.engine:oauth2-sdk-authorization-server (>=2.7.0.beta4, <=2.7.0.10) +2 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.2.3)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authentication (>=2.7.8.1, <=2.7.10.1), cn.herodotus.engine:oauth2-sdk-authentication-server (>=2.7.8.1, <=2.7.10.1) +11 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.4.1)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authorization-server (2.7.0.beta3), cn.herodotus.engine:oauth2-sdk-data-jpa (2.7.0.beta3) potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.2.2)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.2.0.0, <=3.2.2.2), cn.herodotus.engine:oauth2-sdk-authentication (>=3.2.0.0, <=3.2.2.2) +13 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.2.0, <=1.2.2)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.2.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.0.0, =3.0.0, =2.0.0, =1.5.0, =2.0.0, =1.0.0-beta2, =3.2.0, =3.2.3 Source cves: CVE-2024-22258 Source advisory:...

cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.1.5.2, <=3.1.9.2), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.1.0, <=3.1.9.2) +14 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.0.0, <=1.1.5)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.0.0, =3.1.5.2, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.6.4, =2023.0.0.2-alpha.1, =1.3.1, =1.3.0, =1.3.0, =1.0.1-1, =3.1.0, =3.1.9 and more Source cves: CVE-2024-22258 Source advisory:...

cn.herodotus.engine:oauth2-sdk-authentication (>=2.7.12.1, <=2.7.16.final), cn.herodotus.engine:oauth2-sdk-authentication-server (>=2.7.12.1, <=2.7.16.final) +4 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.4.3)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

io.github.marianovarela:qbuilder (>=0.0.2, <=1.0.0) potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.2.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

com.labijie.infra:oauth2-authorization-server-starter (>=1.2.0, <=1.2.5) potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.2.1)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authentication (>=2.7.7.3, <=2.7.8.0), cn.herodotus.engine:oauth2-sdk-authentication-server (>=2.7.7.4, <=2.7.8.0) +11 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.4.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-sdk-authorization (>=2.7.0.20, <=2.7.0.50), cn.herodotus.engine:oauth2-sdk-authorization-server (>=2.7.0.20, <=2.7.0.50) +3 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.3.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.com.xuxiaowei.boot:spring-security-oauth2-authorization-server-redis (2.0.0), com.healthy-chn.cloud:healthy-oauth2-authorization-resource (>=1.3.9-m4, <=2.0.0-m3) +3 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.4.5)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.1.5.2, <=3.1.9.2), cn.herodotus.engine:oauth2-sdk-authentication (>=3.0.1.0, <=3.1.9.2) +14 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.0.0, <=1.1.5)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.0.0, =3.1.5.2, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.6.4, =2023.0.0.2-alpha.1, =1.3.1, =1.3.0, =1.3.0, =1.0.1-1, =3.1.0, =3.1.9 and more Source cves: CVE-2024-22258 Source advisory:...

cn.herodotus.engine:oauth2-sdk-authentication (>=2.7.10.2, <=2.7.12.0), cn.herodotus.engine:oauth2-sdk-authentication-server (>=2.7.10.2, <=2.7.12.0) +8 more potentially affected by CVE-2024-22258 via org.springframework.security:spring-security-oauth2-authorization-server (0.4.2)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...