com.ahome-it:ahome-tooling-server-core (>=1.1.5-release, <=1.1.9-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.5-release, <=1.1.9-release) +54 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.1.2.release)

org.springframework.security:spring-security-web MAVEN version 4.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.5-release,...

africa.absa:inception-oauth2-resource-server (>=1.0.0, <=1.2.0), au.org.consumerdatastandards:client-cli (>=1.13.0, <=2.4.1) +1257 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (>=5.5.0, <=5.5.6)

org.springframework.security:spring-security-web MAVEN version =5.5.0, =1.0.0, =1.13.0, =1.13.0, =1.0.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.4.r, =1.0.4.r, =1.0.4.r, =1.0.4.r, =1.7.26, =1.3.30, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.4-alpha-5 and more Source cves: CVE-2022-22978 Source...

GHSA-HH32-7344-CG2F Authorization bypass in Spring Security

In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +319 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.0.3.release)

org.springframework.security:spring-security-core MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: -...

com.capitalone.dashboard:api (>=3.3.0, <=3.4.52), com.capitalone.dashboard:api-audit (>=3.5.1, <=3.7.33) +81 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.18.release)

org.springframework.security:spring-security-core MAVEN version 4.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.capitalone.dashboard:api =3.3.0, =3.5.1, =3.2.0,...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (j11.2.6.0) +1310 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (>=5.6.0, <=5.6.3)

org.springframework.security:spring-security-web MAVEN version =5.6.0, =4.4.0.2, =0.2.0, =2.1.0.m8, =1.0.0, =2.7.0.beta4, =2.7.0.beta4, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta1, =2.7.0.beta1, =2.7.0.beta2 and more Source cves: CVE-2022-22978 Source advisory:...

com.sitewhere:sitewhere-activemq (>=1.0.2, <=1.4.0), com.sitewhere:sitewhere-azure (>=1.0.2, <=1.4.0) +39 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.2.6.release)

org.springframework.security:spring-security-web MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.sitewhere:sitewhere-activemq =1.0.2, =1.0.2, =1.2.0...

org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4), org.springframework.security:spring-security-cas (3.2.2.release) +3 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.2.2.release)

org.springframework.security:spring-security-web MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.pac4j:spring-security-pac4j =1.2.3, =1.2.4 -...

com.allanditzel:spring-security-csrf-token-filter (1.1), com.btmatthews.atlas:atlas-jcr (1.0.1) +140 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.2.0.release)

org.springframework.security:spring-security-core MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.allanditzel:spring-security-csrf-token-filter 1.1...

com.addc:addc-svr-mvc (>=2.6, <=2.9), com.addc:addc-web-mvc (>=2.6, <=2.9) +93 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.12.release)

org.springframework.security:spring-security-web MAVEN version 4.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.addc:addc-svr-mvc =2.6, =2.6, =2.6, =4.1.2, =4.1.2...

co.paralleluniverse:comsat-spring-boot-security (0.5.0), co.paralleluniverse:comsat-spring-security (0.5.0) +69 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.0.2.release)

org.springframework.security:spring-security-web MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - co.paralleluniverse:comsat-spring-boot-security 0.5.0 -...

com.github.lrkwz:urlmanaged-locale (0.0.1), com.isotrol.impe3.extensions:impe3-pms-ldap (>=3.0.0, <=3.1.1) +69 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.0.7.release)

org.springframework.security:spring-security-core MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.lrkwz:urlmanaged-locale 0.0.1 -...

com.racquettrack:spring-security-oauth2-client (1.4), com.sitewhere:sitewhere-core (0.9.7) +40 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.1.1.release)

org.springframework.security:spring-security-core MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.racquettrack:spring-security-oauth2-client 1.4 -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), at.researchstudio.sat:won-cryptography (>=0.4, <=0.6) +101 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.9.release)

org.springframework.security:spring-security-web MAVEN version 4.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter...

com.ahome-it:ahome-tooling-server-core (>=1.1.5-release, <=1.1.9-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.5-release, <=1.1.9-release) +167 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.1.2.release)

org.springframework.security:spring-security-core MAVEN version 4.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.5-release...

com.auth0:auth0-spring-security-api (>=1.4.1, <=1.5.3), com.dahuatech.harriet.icc:eco-brm-client (>=1.0.1, <=1.0.1.4) +123 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.20.release)

org.springframework.security:spring-security-core MAVEN version 4.2.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:auth0-spring-security-api =1.4.1, =1.0.1,...

at.molindo.social:spring-social-security (1.1.0.release), cn.jhc:spring-social-qq (>=0.0.2, <=0.0.5) +105 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.2.3.release)

org.springframework.security:spring-security-web MAVEN version 3.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - at.molindo.social:spring-social-security 1.1.0.release ...

co.paralleluniverse:comsat-spring-boot-security (0.7.0), co.paralleluniverse:comsat-spring-security (0.7.0) +226 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.0.4.release)

org.springframework.security:spring-security-web MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - co.paralleluniverse:comsat-spring-boot-security 0.7.0 -...

org.apache.syncope:syncope-core (>=1.0.9, <=1.1.8), org.springframework.security:spring-security-cas (3.1.6.release) +5 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.1.6.release)

org.springframework.security:spring-security-web MAVEN version 3.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.apache.syncope:syncope-core =1.0.9, =1.4.9, =1.4.9,...

com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta), com.logitags:cibet (>=1.1, <=1.9) +24 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.0.3.release)

org.springframework.security:spring-security-core MAVEN version 3.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.force.sdk:force-springsecurity =22.0.2-beta, =1.1...