1508 matches found
CVE-2025-4427-CVE-2025-4428
CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...
CVE-2022-22978
CVE-2022-22978: Spring Security Authorization Bypass Summary Spring Security framework is a security framework that provides authentication and authorization functions in Spring-based applications. In Spring Security versions 5.5.6, 5.6.3 and earlier, when using RegexRequestMatcher, a function th...
CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection
CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection Spring Security OAuth 2.3 Open Redirection 分析复现篇 Exploit Title: Open Redirector in spring-security-oauth2 Date: 17 June 2019 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link:...
cve-2025-22235-demo
CVE-2025-22235: Spring Boot EndpointRequest.to Authentication Bypass Vulnerability Demo Vulnerability Description CVE-2025-22235 is a Spring Boot security vulnerability involving the EndpointRequest.to method, which may generate an incorrect matcher when configuring security rules, leading to the...
cve-2023-34034
cve-2023-34034 Demonstration of CVE-2023-34034 authorization bypass in Spring Security. See CVE-2023-34034 Spring Security Authorization Bypass on Don't Panic!...
CVE-2022-22978
CVE-2022-22978 Spring-Security bypass Demo When using RegexRequestMatcher in Spring Security and the regex rule contains a dot ., an attacker can bypass authentication by crafting a malicious packet. Affected Range Spring Security 5.5.x Spring Security 5.6.x http://localhost:8080/admin/index%0a...
CVE-2022-22978-PoC
CVE 2022-22978: تجاوز التفويض في RegexRequestMatcher 🥶 نظرة عامة وفقًا للمعلومات التي وجدتها، فإن هذه الثغرة مرتبطة بفئة RegexRequestMatcher في إطار عمل Spring Security. على وجه التحديد، التطبيقات التي تستخدم RegexRequestMatcher والتي تحتوي تعبيراتها المنتظمة على نقطة . يمكن تجاوزها باستخدام الأح...
CVE-2022-22978
CVE-2022-22978 Spring Security Pass Spring Security 成功 http://localhost:9090/login%0a Pass Spring Security with SayMyName 失敗 http://localhost:9090/name%0d Bypass Spring Security with Custom RBAC 失敗 http://localhost:9090/admin/admin%0d Bypass Spring Security with Annotation RBAC 失敗...
cve-2023-34035-mitigations
This repo is a set of samples to demonstrate the arrangements wherein applications may be vulnerable to https://spring.io/security/cve-2023-34035CVE-2023-34035. An application is vulnerable when all of the following are true: Spring MVC is on the classpath DispatcherServlet and at least one other...
CVE-2022-22978
CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I have gathered, this vulnerability relates to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...
cve-2022-31692
CVE-2022-31692 Demo Overview A simple Spring Boot application demonstrating configuration that is vulnerable to CVE-2022-31692. This vulnerability may attract attention due to its severity - it has a CVSS 3.x base score of 9.8 as it allows authentication bypass. The purpose of this project is to...
SpringSource__spring-security-oauth_CVE-2018-1260_2-3-2-RELEASE
This project provides support for using Spring Security with OAuth 1a and OAuth2. It provides features for implementing both consumers and providers of these protocols using standard Spring and Spring Security programming models and configuration idioms. Code of Conduct This project adheres to th...
ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-38821 CVE-2024-38821 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2024-38821 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...
cve-2026-22732-poc
CVE-2026-22732 — Preuve de concept Spring Security supprime silencieusement les en-têtes de sécurité des réponses HTTP. Démo / usage éducatif uniquement ; ne l'exécutez contre rien d'autre que cette application locale. | ---|--- CVE| CVE-2026-22732 CWE-425, publiée le 2026-03-19 CVSS 3.1| 9.1...
rewrite-cve-2026-22732
rewrite-cve-2026-22732 Recette OpenRewrite qui détecte le code susceptible d'être vulnérable à CVE-2026-22732, un défaut de Spring Security où la définition de Content-Length via l'une des trois méthodes de réponse contourne OnCommittedResponseWrapper de Spring Security. Comme le wrapper ne voit...
xbootEncodePwd
xbootEncodePwd xboot-activiti-1.0-SNAPSHOT xboot-cms-1.0-SNAPSHOT xboot-generator-1.0-SNAPSHOT xboot-app-1.0-SNAPSHOT xboot-core-1.0-SNAPSHOT xboot-open-1.0-SNAPSHOT xboot-autochat-1.0-SNAPSHOT xboot-docking-1.0-SNAPSHOT xboot-quartz-1.0-SNAPSHOT xboot-base-1.0-SNAPSHOT xboot-ems-1.0-SNAPSHOT...
GSSC-CVE-2022-41923
Workaround for CVE-2022-41923: Privilege Management Vulnerability Summary The vulnerability CVE-2022-41923 found in the unpatched Grails Spring Security Core GSSC plugin can result in improper privilege management. This repository describes how to work around the issue. If you are using an...
cve-2026-22732-demo
Démo CVE-2026-22732 Reproduction minimale de CVE-2026-22732 — les en-têtes de réponse HTTP de Spring Security sont silencieusement supprimés lorsque le code du contrôleur écrit directement dans la réponse du servlet. La vulnérabilité Spring Security utilise l'écriture « paresseuse » des en-têtes...