GSSC-CVE-2022-41923

CVE-2022-41923 해결 방법: 권한 관리 취약점 요약 패치되지 않은 Grails Spring Security Core GSSC 플러그인에서 발견된 취약점 CVE-2022-41923은 부적절한 권한 관리로 이어질 수 있습니다. 이 저장소는 이 문제를 해결하는 방법을 설명합니다. 패치되지 않은 버전의 플러그인을 사용 중인 경우, 패치된 버전으로 업그레이드할 것을 강력히 권장합니다. 즉시 업그레이드할 수 없는 경우, 이 문서에 설명된 해결 방법을 구현하는 것이 좋습니다. 이는 특히 GSSC 플러그인 버전 2.x를 사용하는 ...

cve-2026-22732-demo

CVE-2026-22732 デモ CVE-2026-22732 の最小再現 — コントローラコードがサーブレットレスポンスに直接書き込む際に、Spring Security の HTTP レスポンスヘッダーが静かに破棄される問題。 脆弱性 Spring Security はデフォルトで「遅延」ヘッダー書き込みを使用します。コントローラが response.getOutputStream に書き込む、response.flushBuffer を呼び出す、または setIntHeader で Content-Length を設定すると、Spring Security...

CVE-2026-84860

ScadaLTS 2.8.1-release-candidate build 0 suffers from an Authorization Bypass in its DWR (Direct Web Remoting) component. Spring Security restricts DWR endpoints by URL path pattern , but DWR actually dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName . Addi...

Spring-CVE-2022-22947-

このリポジトリには README がありません。...

CVE-2024-38821-POC

CVE-2024-38821: 개념 증명PoC: Spring Framework의 인증 우회 이는 CVE-2024-38821 취약점에 대한 개념 증명입니다. 실행 단계 1. 도커 이미지 빌드 Spring Boot 3.3.4, Spring Framework 6.1.13 기반 root@kitploit: cd vuln docker build -t cve-2024-38821-poc . 2. 컨테이너를 실행하고 호스트 머신에 포트 8080 노출 root@kitploit: docker run -d -p 8080:8080 --name...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428은 EPMM의 DeviceFeatureUsageReportQueryRequestValidator에서 발생하는 인증 후post-auth 원격 코드 실행RCE 취약점입니다. 이는 Spring의 AbstractMessageSource를 통해 처리되는 오류 메시지 내에서 사용자 제공 입력을 안전하지 않게 처리하여 발생하며, 공격자가 제어하는 ELExpression Language 주입을 허용합니다. /api/v2/featureusage 엔드포인트의 조작된...

CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection

CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection Spring Security OAuth 2.3 Open Redirection 분석 및 재현 편 Exploit Title: spring-security-oauth2의 Open Redirector Date: 2019년 6월 17일 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link:...

CVE-2026-89054

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

EUVD-2026-75707

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CLEANSTART-2026-GZ54612 In Spring Security, versions 5

Multiple security vulnerabilities affect the apache-nifi package. In Spring Security, versions 5. See references for individual vulnerability details...

UnboundID LDAP Server Administrative Credential Exposure

Spring Security is vulnerable to an UnboundID LDAP Server Administrative Credential Exposure. The vulnerability is due to the embedded UnboundID LDAP server UnboundIdContainer unconditionally registering an administrative credential and binding its listener to all available network interfaces,...

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-59277

Spring Security InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. In Spring Security 7.1.0, the internal address classification did...

CLSA-2026-1788333969 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.4.13-tuxcare.4...

CLSA-2026-1788251580 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.5.11-tuxcare.1...

ROOT-APP-MAVEN-AIKIDO-2026-61483 AIKIDO-2026-61483 in org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched AIKIDO-2026-61483 in the org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

CVE-2026-47842

A flaw was found in Spring Security. Applications configured to use AesBytesEncryptor with a two-argument constructor or a null Initialization Vector IV generator in Cipher Block Chaining CBC mode will encrypt data using a predictable, all-zero IV. This deterministic encryption allows an attacker...

CLSA-2026-1787929170 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.11-tuxcare.8...

CLSA-2026-1787919833 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.14-tuxcare.6...

Security Bulletin: Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods API Management

Summary Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods developer portal and IBM webMethos API ControlPlane. Vulnerability Details CVEID:CVE-2026-22746 DESCRIPTION: Vulnerability in Spring Spring Security. If an application is using the...