ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11) +7645 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (>=2.0.0, <=5.4.10)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =4.4.0.0, =0.1.8, =0.1.6, =0.1.2, =0.5.0, =j8.2.4.0, =j8.2.4.0, =1.0.0, =1.0.0, =1.0.0, =0.0.2, =0.0.3, =1.1.0.release, =0.3, =0.3, =0.6 and more Source cves: CVE-2022-22978 Source advisory: MEND:CVE-2022-22978...

CVE-2022-22978

CVE-2022-22978 involves a bypass in Spring Security’s RegexRequestMatcher where a dot (.) in the regex can bypass authorization on certain servlet containers. Affected are Spring Security versions prior to 5.4.11+, 5.5.7+, 5.6.4+ and older unsupported releases. Connected reports show remediation ...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +1535 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (>=5.5.0, <=5.5.6)

org.springframework.security:spring-security-core MAVEN version =5.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.13.0, =1.13.0, =2.2.0 - be.jidoka:jdk-keycloak-admin 1.2.0 and more Source cves: CVE-2022-22978 Source advisory:...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (j11.2.6.0) +1524 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (>=5.6.0, <=5.6.3)

org.springframework.security:spring-security-core MAVEN version =5.6.0, =4.4.0.2, =1.3.1.release, =0.2.0, =0.8.3, =2.1.0.m8, =1.0.0, =2.7.0.beta3, =2.7.0.beta4, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.rc1 and more Source cves: CVE-2022-22978 Source advisory: MEND:CVE-2022-22978...

PT-2022-3458

Name of the Vulnerable Software and Affected Versions Spring Security versions prior to 5.4.11 Spring Security versions prior to 5.5.7 Spring Security versions prior to 5.6.4 Spring Security older unsupported versions Description The issue is related to the RegexRequestMatcher component in Spring...

PT-2022-15752

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.5.x prior to 5.5.7 Spring Security versions 5.6.x prior to 5.6.4 Spring Security earlier unsupported versions Description The issue is related to an integer overflow vulnerability. When using the BCrypt class with th...

africa.absa:inception-oauth2-resource-server (>=1.0.0, <=1.2.0), au.org.consumerdatastandards:client-cli (>=1.13.0, <=2.4.1) +1257 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (>=5.5.0, <=5.5.6)

org.springframework.security:spring-security-web MAVEN version =5.5.0, =1.0.0, =1.13.0, =1.13.0, =1.0.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.4.r, =1.0.4.r, =1.0.4.r, =1.0.4.r, =1.7.26, =1.3.30, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.4-alpha-5 and more Source cves: CVE-2022-22978 Source...

CVE-2022-22978

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11) +6003 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (>=3.0.0.release, <=5.4.10)

org.springframework.security:spring-security-web MAVEN version =3.0.0.release, =4.4.0.0, =0.1.8, =0.1.6, =0.1.2, =0.5.0, =j8.2.4.0, =j8.2.4.0, =1.0.0, =1.0.0, =1.0.0, =0.0.2, =0.0.3, =1.1.0.release, =0.3, =0.3, =0.6 and more Source cves: CVE-2022-22978 Source advisory: MEND:CVE-2022-22978...

CVE-2022-22978

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with "." in the regular expression are possibly vulnerable to an...

CVE-2022-22978

A flaw was found in Spring Security. When using RegexRequestMatcher, an easy misconfiguration can bypass some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

Improper Control of Generation of Code in Spring Security

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter...

GHSA-5XM9-RF63-WJ7H Improper Control of Generation of Code in Spring Security

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2732 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2732 Source advisory:...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2732 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2732 Source advisory:...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2732 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2732 Source advisory:...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2732 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2732 Source advisory: GHSA-5XM9-RF63-WJ...

com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6) +171 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.2.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =1.3.6, =1.5, =1.0.0, =3.0.4, =3.3, =1.1.3, =1.1.4, =1.1.3, =1.0.2, =1.0.3 - com.racquettrack:spring-security-oauth2-client 1.4 - com.sitewhere:sitewhere-core 0.9.7 and more Source cves: CVE-2012-5055 Source advisory:...

GHSA-3533-RVPC-6X56 Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of logi...

com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6) +171 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.2.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =1.3.6, =1.5, =1.0.0, =3.0.4, =3.3, =1.1.3, =1.1.4, =1.1.3, =1.0.2, =1.0.3 - com.racquettrack:spring-security-oauth2-client 1.4 - com.sitewhere:sitewhere-core 0.9.7 and more Source cves: CVE-2012-5055 Source advisory:...