mil.navy.spawar.soaf:soaf-generic-security-module (1.0.0), mil.navy.spawar.soaf:soaf-parent (>=1.0.0, <=1.0.3) +17 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.7.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - mil.navy.spawar.soaf:soaf-generic-security-module 1.0.0...

net.unicon.cas:cas-addons (>=1.1-rc1, <=1.7), net.unicon.cas:cas-java-clients-addons (0.5) +12 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.3.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - net.unicon.cas:cas-addons =1.1-rc1, =3.5-rc1, =3.5-rc1,...

com.cedac.spring.security:spring-security-mongodb (1.0.0), com.foreach.across.modules:admin-web-module (>=1.0.0.release, <=1.1.0.release) +127 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.7.release)

org.springframework.security:spring-security-core MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.cedac.spring.security:spring-security-mongodb 1.0...

com.racquettrack:spring-security-oauth2-client (1.4), com.sitewhere:sitewhere-core (0.9.7) +40 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.1.release)

org.springframework.security:spring-security-core MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.racquettrack:spring-security-oauth2-client 1.4 -...

org.ff4j:ff4j-security-spring (>=1.0.0, <=1.1.0), org.springframework.security:spring-security-acl (3.0.8.release) +7 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.0.8.release)

org.springframework.security:spring-security-core MAVEN version 3.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.ff4j:ff4j-security-spring =1.0.0, =1.1.0 -...

com.sitewhere:sitewhere-activemq (>=1.0.2, <=1.4.0), com.sitewhere:sitewhere-azure (>=1.0.2, <=1.4.0) +68 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.6.release)

org.springframework.security:spring-security-core MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.sitewhere:sitewhere-activemq =1.0.2, =1.0.2,...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.4, <=3.0.1), br.net.woodstock.rockframework:rockframework-persistence (>=2.0.0, <=2.0.8) +23 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.0.6.release)

org.springframework.security:spring-security-core MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - br.net.woodstock.rockframework:rockframework-domain...

cn.dceast.platform:platform-security-starter (2.2.3), com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.0.114-release) +18 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (>=4.0.1.release, <=4.2.8.release)

org.springframework.security:spring-security-cas MAVEN version =4.0.1.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.0.83-rc1, =1.0.83-rc1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =9.4.0.10, =0.3.1, =0.3.1, =0.3.2 - net.eulerframework:euler-web-authentication-impl-hibernate 0.3.9 and more Source cves...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11), ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7) +2345 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (>=4.0.0.release, <=4.2.12.release)

org.springframework.security:spring-security-core MAVEN version =4.0.0.release, =0.1.8, =0.1.6, =0.1.4-sb1x, =1.0.0, =1.0.0, =1.0.0, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 and more Source cves: CVE-2019-11272 Source advisory:...

com.github.dblock.waffle:waffle-spring-security2 (>=1.7, <=1.7.5), com.googlecode.cedar-common:cedar-common-gae (>=2.1.3, <=5.8.4) +12 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.8.release)

org.springframework.security:spring-security-core MAVEN version 2.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security2 =1.7...

org.eobjects.datacleaner:datacleaner-monitor-completeness-analysis-wizard (>=5.0-rc1, <=5.1.5.3), org.eobjects.datacleaner:datacleaner-monitor-copy-data-wizard (>=5.0-rc1, <=5.1.5.3) +11 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.9.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: -...

com.github.dblock.waffle:waffle-spring-security2 (>=1.5, <=1.6), com.microsoftopentechnologies:azure-slave (>=0.1.0, <=0.3.0) +201 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.7.release)

org.springframework.security:spring-security-core MAVEN version 2.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security2 =1.5...

Insufficiently Protected Credentials and Improper Authentication in Spring Security

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

com.github.cwilper.fcrepo-cloudsync:fcrepo-cloudsync-service (>=1.0.0-beta-1, <=1.0.0), com.github.lltyk:tapestry-spring-security (>=3.0.2, <=3.0.3) +199 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.0.5.release)

org.springframework.security:spring-security-core MAVEN version 3.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: -...

com.github.jackpanz:maccloud-core (>=2.4.7, <=2.4.8), com.gwtincubator:gwt-incubator-security (1.0.1) +74 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.4)

org.springframework.security:spring-security-core MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.jackpanz:maccloud-core =2.4.7, =1.1-1, =1.1-2 -...

cc.ereach:ereach-boot-starter-security (1.0.1), com.ge.predix:uaa-token-lib (>=3.3.2, <=4.0.1) +114 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.10.release)

org.springframework.security:spring-security-core MAVEN version 3.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cc.ereach:ereach-boot-starter-security 1.0.1 -...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-acl (3.0.1.release) +13 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.0.1.release)

org.springframework.security:spring-security-core MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

GHSA-V33X-PRHC-GPH5 Insufficiently Protected Credentials and Improper Authentication in Spring Security

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

org.opencastproject:opencast-security-cas (6.6) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.4.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.opencastproject:opencast-security-cas 6.6 Source...

at.molindo.social:spring-social-security (1.1.0.release), cn.jhc:spring-social-qq (>=0.0.2, <=0.0.5) +128 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.3.release)

org.springframework.security:spring-security-core MAVEN version 3.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - at.molindo.social:spring-social-security 1.1.0.releas...