com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6) +171 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.2.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =1.3.6, =1.5, =1.0.0, =3.0.4, =3.3, =1.1.3, =1.1.4, =1.1.3, =1.0.2, =1.0.3 - com.racquettrack:spring-security-oauth2-client 1.4 - com.sitewhere:sitewhere-core 0.9.7 and more Source cves: CVE-2012-5055 Source advisory:...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=3.0.1), br.net.woodstock.rockframework:rockframework-persistence (>=2.0.0, <=2.0.8) +270 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.7.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =2.0.0, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =3.0.0, =1.2.0, =1.1, =0.1, =1.2-1, =1.0, =1.0.2 - com.revolsys.open:com.revolsys.open.gis.web 2011.11.07.release and more Source cves: CVE-2012-5055 Source advisor...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +300 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.7.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.5, =1.6 and more Source cves: CVE-2012-5055 Source advisory: GHSA-3533-RVPC-6X56...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +300 more potentially affected by CVE-2012-5055 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.7.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.5, =1.6 and more Source cves: CVE-2012-5055 Source advisory: OSV:GHSA-3533-RVPC-6X...

GHSA-4644-HG35-55M9 Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2731 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2731 Source advisory:...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2731 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2731 Source advisory:...

Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2731 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2731 Source advisory: GHSA-4644-HG35-55...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2731 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2731 Source advisory:...

BCrypt skips salt rounds for work factor of 31

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor 31, the encoder does not perform any salt rounds, due to an integer overflow error. The default...

VMware Spring Security Authorization Vulnerability

VMware Spring Security is a security framework from VMware that provides illustrative security protections for Spring-based applications. An authorization issue vulnerability exists in VMware Spring Security that stems from the use of RegexRequestMatcher and the wildcard . character of a regular...

CVE-2022-22976: BCrypt skips salt rounds for work factor of 31

Spring Security 5.7.0, 5.6.4, 5.5.7 were released to fix CVE-2022-22976: BCrypt skips salt rounds for work factor of 31. Please update as soon as possible...

CVE-2022-22978: Authorization Bypass in RegexRequestMatcher

UPDATES 05-17 Due to a mixup CVE-2022-22975 should have been CVE-2022-22978. The blog has been updated to reflect this correction. CVE-2022-22978 : Authorization Bypass in RegexRequestMatcher Spring Security 5.7.0, 5.6.4, 5.5.7 were released to fix CVE-2022-22978 : Authorization Bypass in...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2894 Source advisory:...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2894 Source advisory:...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2894 Source advisory:...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2894 Source advisory: GHSA-F866-M9MV-2X...

Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by 1 serializing a...

GHSA-3295-H9QX-R82X Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server WAS 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter...