br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +30 more potentially affected by CVE-2010-3700 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.3.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.2.0, =1.1, =1.2-1, =3.49, =1.4.5.1, =2.4.0, =2.4.0, =1.20, =1.6, =1.6, =1.6, =3.9.ss3, =3.19.ss3 and more Source cves: CVE-2010-3700 Source advisory: GHSA-3295-H9QX-R82X...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +30 more potentially affected by CVE-2010-3700 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.3.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.2.0, =1.1, =1.2-1, =3.49, =1.4.5.1, =2.4.0, =2.4.0, =1.20, =1.6, =1.6, =1.6, =3.9.ss3, =3.19.ss3 and more Source cves: CVE-2010-3700 Source advisory: OSV:GHSA-3295-H9QX-R82X...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +103 more potentially affected by CVE-2010-3700 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.5.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2010-3700 Source advisory:...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +103 more potentially affected by CVE-2010-3700 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.5.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2010-3700 Source advisory: GHSA-3295-H9QX-R8...

Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server WAS 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter...

Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple vulnerabilities due to Spring Security

Summary Spring Security is used by IBM Sterling B2B Integrator. Multiple Spring Security vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2019-3795 DESCRIPTION: Pivotal Spring Security could provide weaker than expected security, caused by an insecure randomness flaw when usin...

Deserialization of Untrusted Data in Spring Security

An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by...

GHSA-VHRG-V3CV-P247 Deserialization of Untrusted Data in Spring Security

An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +732 more potentially affected by CVE-2017-4995 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.2.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =1.3.0, =1.3.0, =1.3.0, =0.2.0, =1.0.3, =1.1.19-release, =1.1.23-release, =1.1.19-release, =1.1.19-release, =1.1.23-release, =1.3.2, =1.3.2, =1.3.2, =1.5.1 and more Source cves: CVE-2017-4995 Source advisory:...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +732 more potentially affected by CVE-2017-4995 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.2.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =1.3.0, =1.3.0, =1.3.0, =0.2.0, =1.0.3, =1.1.19-release, =1.1.23-release, =1.1.19-release, =1.1.19-release, =1.1.23-release, =1.3.2, =1.3.2, =1.3.2, =1.5.1 and more Source cves: CVE-2017-4995 Source advisory:...

GHSA-GV9V-C375-HVMG Improper Authentication in Spring Security

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password...

com.aerse:gcless (11.2), com.aerse:spring-security-taglib (1.1) +239 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.2.0.release, <=3.2.1.release)

org.springframework.security:spring-security-core MAVEN version =3.2.0.release, =0.0.1, =3.4, =3.0.0, =1.0.50, =1.0.52 - com.microsoftopentechnologies:windows-azure-storage-plugin 0.3.1 and more Source cves: CVE-2014-0097 Source advisory: GHSA-GV9V-C375-HVMG...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.arsframework:ars-module-cms (>=1.0.0, <=1.1.4) +379 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.4.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =0.3.3, =1.0.0, =1.0.0, =1.0.0, =1.2.1, =1.2.1, =1.3.6, =1.0.0-alpha2, =1.5, =1.0.0, =3.0.4, =3.0.5 - com.github.ptomli.bedrock:bedrock-core 1.0.0 - com.github.yongjacky:jee.borneo.miri 1.1.6 -...

Improper Authentication in Spring Security

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password...

com.aerse:gcless (11.2), com.aerse:spring-security-taglib (1.1) +239 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.2.0.release, <=3.2.1.release)

org.springframework.security:spring-security-core MAVEN version =3.2.0.release, =0.0.1, =3.4, =3.0.0, =1.0.50, =1.0.52 - com.microsoftopentechnologies:windows-azure-storage-plugin 0.3.1 and more Source cves: CVE-2014-0097 Source advisory: OSV:GHSA-GV9V-C375-HVMG...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.arsframework:ars-module-cms (>=1.0.0, <=1.1.4) +379 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.4.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =0.3.3, =1.0.0, =1.0.0, =1.0.0, =1.2.1, =1.2.1, =1.3.6, =1.0.0-alpha2, =1.5, =1.0.0, =3.0.4, =3.0.5 - com.github.ptomli.bedrock:bedrock-core 1.0.0 - com.github.yongjacky:jee.borneo.miri 1.1.6 -...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +19 more potentially affected by CVE-2022-22970 via org.springframework:spring-beans (2.0-m2)

org.springframework:spring-beans MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-beans and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0 - org.acegisecurity:acegi-security-adapter...

This Week in Spring - April 26th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! This week I was hoping to be in glorious Chicago, Illinois for the first in-person SpringOne Tour installment since the pandemic. But, alas, I couldnt go because - out of an abundance of caution, and since I was exposed to...

Pivotal Spring Security Oauth Resource Management Error Vulnerability

A resource management error vulnerability exists in Pivotal Spring Security OAuth, a login system from Pivotal, Inc. that provides support for adding OAuth1 and OAuth2 functionality to Spring Web applications. The vulnerability stems from improper handling of a large number of message requests. A...

Denial Of Service (DoS)

Spring Security OAuth is vulnerable to denial of service. The vulnerability exists due to a lack of restriction of the number of request initiating the Authorization Request for the Authorization Code Grant allowing an attacker to exhaust the system resources sending multiple requests with a sing...