com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +48 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.2.4.release)

org.springframework.security:spring-security-core MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-security-oauth2-jose (5.0.6.release_1), org.springframework.security:spring-security-oauth2-jose (5.0.6.release) potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (5.11)

com.nimbusds:nimbus-jose-jwt MAVEN version 5.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-security-oauth2-jose 5.0.6.release1 -...

com.c4-soft.springaddons:spring-security-oauth2-test-addons (>=2.0.0, <=2.0.3), com.c4-soft.springaddons:spring-security-oauth2-test-webflux-addons (>=2.0.0, <=2.0.3) +67 more potentially affected by CVE-2023-6927 via org.keycloak:keycloak-core (9.0.0)

org.keycloak:keycloak-core MAVEN version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.c4-soft.springaddons:spring-security-oauth2-test-addons =2.0.0, =2.0.0, =2.0.0, =1.1.0, =1.1.0, =1.1.0,...

Important: Red Hat Security Advisory: Migration Toolkit for Runtimes security bug fix and enhancement update

Migration Toolkit for Runtimes 1.0.2 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Privilege Escalation

Spring Security OAuth2 Client is vulnerable to Privilege Escalation. The vulnerability exists in the getTokenResponse function in multiple files due to the authorization server responding with an OAuth2 access token response containing an empty scope list which allows an attacker to modify reques...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +573 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.0.4.release, <=5.6.8)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.0.4.release, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.1, =0.3 - cn.itlym:shoulder-security-code 0.3 - cn.itlym:shoulder-starter-auth-server 0.3 -...

cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.0) +216 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =0.1.40 - com.graphql-java-generator:graphql-java-client-dependencies 1.18.8 - com.graphql-java-generator:graphql-java-client-runtime...

cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.0) +216 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =0.1.40 - com.graphql-java-generator:graphql-java-client-dependencies 1.18.8 - com.graphql-java-generator:graphql-java-client-runtime...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +573 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.0.4.release, <=5.6.8)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.0.4.release, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.1, =0.3 - cn.itlym:shoulder-security-code 0.3 - cn.itlym:shoulder-starter-auth-server 0.3 -...

cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.0) +216 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =0.1.40 - com.graphql-java-generator:graphql-java-client-dependencies 1.18.8 - com.graphql-java-generator:graphql-java-client-runtime...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +573 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.0.4.release, <=5.6.8)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.0.4.release, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.1, =0.3 - cn.itlym:shoulder-security-code 0.3 - cn.itlym:shoulder-starter-auth-server 0.3 -...

Denial Of Service (DoS)

org.springframework.security:spring-security-oauth2-client is vulnerable to denial of service DoS attacks. An attacker is able to cause resource exhaustion via sending multiple requests initiating the authorization request for the authorization code grant using a single session or multiple...

com.nortal.jroad.starter:j-road-client (0.3.0), com.nortal.jroad.starter:j-road-server (0.3.0) +19 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.0.19.release)

org.springframework:spring-web MAVEN version 5.0.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.nortal.jroad.starter:j-road-client 0.3.0 - com.nortal.jroad.starter:j-road-server 0.3....

com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +48 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.2.4.release)

org.springframework.security:spring-security-core MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

com.atlassian.connect:atlassian-connect-spring-boot-api (>=2.0.2, <=2.0.7), com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.0.2, <=2.0.7) +35 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.4.0.release, <=2.4.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.4.0.release, =2.0.2, =2.0.2, =2.0.2, =2.0.2, =0.0.5, =0.0.5, =0.0.5, =5.0.0, =5.0.0, =4.59.5, =1.0.10.release, =1.0.10.release, =1.0.10.release, =1.73.8, =1.106.2 and more Source cves: CVE-2022-22969 Source advisory:...

com.atlassian.connect:atlassian-connect-spring-boot-api (>=2.0.2, <=2.0.7), com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.0.2, <=2.0.7) +35 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.4.0.release, <=2.4.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.4.0.release, =2.0.2, =2.0.2, =2.0.2, =2.0.2, =0.0.5, =0.0.5, =0.0.5, =5.0.0, =5.0.0, =4.59.5, =1.0.10.release, =1.0.10.release, =1.0.10.release, =1.73.8, =1.106.2 and more Source cves: CVE-2022-22969 Source advisory:...

cn.infrabase:infrabase-platform-passport (0.0.1), cn.itlym:shoulder-starter-auth-server (0.6) +263 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.5.0.release, <=2.5.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.5.0.release, =1.1.0, =1.1.0, =1.129.9, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =3.2.1.release, =5.0.0, =1.4.11, =1.4.11, =1.5.7 and more Source cves: CVE-2022-22969 Source advisory: GHSA-C2CP-3XJ9-97W9...

cn.infrabase:infrabase-platform-passport (0.0.1), cn.itlym:shoulder-starter-auth-server (0.6) +263 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.5.0.release, <=2.5.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.5.0.release, =1.1.0, =1.1.0, =1.129.9, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =3.2.1.release, =5.0.0, =1.4.11, =1.4.11, =1.5.7 and more Source cves: CVE-2022-22969 Source advisory: OSV:GHSA-C2CP-3XJ9-97W9...

cn.infrabase:infrabase-platform-passport (0.0.1), cn.itlym:shoulder-starter-auth-server (0.6) +263 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.5.0.release, <=2.5.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.5.0.release, =1.1.0, =1.1.0, =1.129.9, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =3.2.1.release, =5.0.0, =1.4.11, =1.4.11, =1.5.7 and more Source cves: CVE-2022-22969 Source advisory: MEND:CVE-2022-22969...

com.atlassian.connect:atlassian-connect-spring-boot-api (>=2.0.2, <=2.0.7), com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.0.2, <=2.0.7) +35 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.4.0.release, <=2.4.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.4.0.release, =2.0.2, =2.0.2, =2.0.2, =2.0.2, =0.0.5, =0.0.5, =0.0.5, =5.0.0, =5.0.0, =4.59.5, =1.0.10.release, =1.0.10.release, =1.0.10.release, =1.73.8, =1.106.2 and more Source cves: CVE-2022-22969 Source advisory:...