be.dnsbelgium:rdap-server (1.1.0), co.paralleluniverse:comsat-spring-boot-security (0.4.0) +98 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.0.1.release)

org.springframework.security:spring-security-core MAVEN version 4.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - be.dnsbelgium:rdap-server 1.1.0 -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.11), ch.sharedvd.tipi:tipi-engine (>=1.1.10, <=1.1.11) +138 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.7.release)

org.springframework.security:spring-security-web MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter...

at.molindo.social:spring-social-security (1.1.0.release), cn.jhc:spring-social-qq (>=0.0.2, <=0.0.5) +128 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.2.3.release)

org.springframework.security:spring-security-core MAVEN version 3.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - at.molindo.social:spring-social-security 1.1.0.releas...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), at.researchstudio.sat:won-cryptography (>=0.4, <=0.6) +101 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.9.release)

org.springframework.security:spring-security-web MAVEN version 4.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter...

co.paralleluniverse:comsat-spring-boot-security (0.5.0), co.paralleluniverse:comsat-spring-security (0.5.0) +69 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.0.2.release)

org.springframework.security:spring-security-web MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - co.paralleluniverse:comsat-spring-boot-security 0.5.0 -...

org.springframework.security:spring-security-acl (2.0.0), org.springframework.security:spring-security-adapters (2.0.0) +18 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (2.0.0)

org.springframework.security:spring-security-core MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.0 -...

com.auth0:auth0-spring-security-api (>=1.3.1, <=1.4.0), com.capitalone.dashboard:hygieia-common (>=4.0.5, <=4.1.0) +43 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.15.release)

org.springframework.security:spring-security-core MAVEN version 4.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:auth0-spring-security-api =1.3.1, =4.0.5,...

Authorization bypass in Spring Security

In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

GHSA-HH32-7344-CG2F Authorization bypass in Spring Security

In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

com.github.lrkwz:urlmanaged-locale (0.0.1), com.revolsys.open:com.revolsys.open.orm (>=2012.07.30.release, <=2012.11.01.release) +30 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.0.7.release)

org.springframework.security:spring-security-web MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.lrkwz:urlmanaged-locale 0.0.1 -...

com.github.leleuj.springframework.security:spring-security-oauth-client (>=1.0.0, <=1.1.0), com.github.lltyk:tapestry-spring-security (>=3.0.4, <=3.0.5) +72 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.1.0.release)

org.springframework.security:spring-security-web MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: -...

com.addc:addc-svr-mvc (>=2.6, <=2.9), com.addc:addc-web-mvc (>=2.6, <=2.9) +93 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.12.release)

org.springframework.security:spring-security-web MAVEN version 4.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.addc:addc-svr-mvc =2.6, =2.6, =2.6, =4.1.2, =4.1.2...

com.auth0:auth0-spring-security-api (>=1.4.1, <=1.5.3), com.dahuatech.harriet.icc:eco-brm-client (>=1.0.1, <=1.0.1.4) +123 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.20.release)

org.springframework.security:spring-security-core MAVEN version 4.2.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:auth0-spring-security-api =1.4.1, =1.0.1,...

fr.xebia.springframework:xebia-spring-security-extras (>=1.1.4, <=1.1.6), org.appfuse:appfuse-jsf (2.1.0-m2) +27 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.0.4.release)

org.springframework.security:spring-security-web MAVEN version 3.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - fr.xebia.springframework:xebia-spring-security-extras...

cn.springcloud.gray:spring-cloud-gray-server (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-cluster-http-synchro-plugin (>=a.2.0.0.rc1, <=a.2.0.0) +156 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.13.release)

org.springframework.security:spring-security-web MAVEN version 4.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.springcloud.gray:spring-cloud-gray-server =a.1.1.1,...

org.apache.ranger:ranger-kylin-plugin (>=2.3.0, <=2.4.0), org.apache.ranger:ranger-kylin-plugin-shim (>=2.3.0, <=2.4.0) +12 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.14.release)

org.springframework.security:spring-security-core MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.ranger:ranger-kylin-plugin =2.3.0, =2.3.0...

com.addc:addc-web-mvc (2.5), com.addc:addc-web-struts12 (2.5) +168 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.4.release)

org.springframework.security:spring-security-web MAVEN version 4.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.addc:addc-web-mvc 2.5 - com.addc:addc-web-struts12...

com.capitalone.dashboard:api (>=3.3.0, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.5.1, <=3.7.33) +81 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.18.release)

org.springframework.security:spring-security-core MAVEN version 4.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.capitalone.dashboard:api =3.3.0, =3.5.1, =3.2.0,...

com.github.fosin:cdp-oauth2 (1.0.0.release), com.sap.cloud.lm.sl.cf:com.sap.cloud.lm.sl.cf.client (>=1.65.4, <=1.67.1) +140 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.8.release)

org.springframework.security:spring-security-core MAVEN version 4.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.fosin:cdp-oauth2 1.0.0.release -...

com.silicolife.textmining:core (>=1.0.3, <=1.1.0), org.ff4j:ff4j-security-spring (>=1.8.2, <=1.8.7) +24 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.1.5.release)

org.springframework.security:spring-security-core MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.silicolife.textmining:core =1.0.3, =1.8.2, =1.8.7...