br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2731 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2731 Source advisory:...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2731 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2731 Source advisory: GHSA-4644-HG35-55...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2731 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2731 Source advisory:...

BCrypt skips salt rounds for work factor of 31

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor 31, the encoder does not perform any salt rounds, due to an integer overflow error. The default...

VMware Spring Security Authorization Vulnerability

VMware Spring Security is a security framework from VMware that provides illustrative security protections for Spring-based applications. An authorization issue vulnerability exists in VMware Spring Security that stems from the use of RegexRequestMatcher and the wildcard . character of a regular...

CVE-2022-22976: BCrypt skips salt rounds for work factor of 31

Spring Security 5.7.0, 5.6.4, 5.5.7 were released to fix CVE-2022-22976: BCrypt skips salt rounds for work factor of 31. Please update as soon as possible...

CVE-2022-22978: Authorization Bypass in RegexRequestMatcher

UPDATES 05-17 Due to a mixup CVE-2022-22975 should have been CVE-2022-22978. The blog has been updated to reflect this correction. CVE-2022-22978 : Authorization Bypass in RegexRequestMatcher Spring Security 5.7.0, 5.6.4, 5.5.7 were released to fix CVE-2022-22978 : Authorization Bypass in...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2894 Source advisory:...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2894 Source advisory:...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2894 Source advisory: GHSA-F866-M9MV-2X...

Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by 1 serializing a...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2894 Source advisory:...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +30 more potentially affected by CVE-2010-3700 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.3.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.2.0, =1.1, =1.2-1, =3.49, =1.4.5.1, =2.4.0, =2.4.0, =1.20, =1.6, =1.6, =1.6, =3.9.ss3, =3.19.ss3 and more Source cves: CVE-2010-3700 Source advisory: GHSA-3295-H9QX-R82X...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +103 more potentially affected by CVE-2010-3700 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.5.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2010-3700 Source advisory: GHSA-3295-H9QX-R8...

Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server WAS 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +103 more potentially affected by CVE-2010-3700 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.5.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2010-3700 Source advisory:...

GHSA-3295-H9QX-R82X Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server WAS 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +30 more potentially affected by CVE-2010-3700 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.3.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.2.0, =1.1, =1.2-1, =3.49, =1.4.5.1, =2.4.0, =2.4.0, =1.20, =1.6, =1.6, =1.6, =3.9.ss3, =3.19.ss3 and more Source cves: CVE-2010-3700 Source advisory: OSV:GHSA-3295-H9QX-R82X...

Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple vulnerabilities due to Spring Security

Summary Spring Security is used by IBM Sterling B2B Integrator. Multiple Spring Security vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2019-3795 DESCRIPTION: Pivotal Spring Security could provide weaker than expected security, caused by an insecure randomness flaw when usin...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +732 more potentially affected by CVE-2017-4995 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.2.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =1.3.0, =1.3.0, =1.3.0, =0.2.0, =1.0.3, =1.1.19-release, =1.1.23-release, =1.1.19-release, =1.1.19-release, =1.1.23-release, =1.3.2, =1.3.2, =1.3.2, =1.5.1 and more Source cves: CVE-2017-4995 Source advisory:...