com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6), com.paddypowerbetfair.springframework:spring-security-saml-keys-rollover (1.0.2) +45 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.2.release)

org.springframework.security:spring-security-core MAVEN version 3.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security3 =1.5...

org.apache.syncope:syncope-core (>=1.0.9, <=1.1.8), org.springframework.security:spring-security-acl (3.1.6.release) +11 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.6.release)

org.springframework.security:spring-security-core MAVEN version 3.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.syncope:syncope-core =1.0.9, =1.4.9, =1.4....

org.opencastproject:opencast-security-cas (>=7.2, <=18.5) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.7.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.opencastproject:opencast-security-cas =7.2, =18.5...

com.myjeeva:spring-extensions (>=1.0.0, <=1.0.1), org.springframework.security:spring-security-acl (2.0.6.release) +6 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.6.release)

org.springframework.security:spring-security-core MAVEN version 2.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.myjeeva:spring-extensions =1.0.0, =1.0.1 -...

org.appfuse.archetypes:appfuse-basic-jsf (2.0.2), org.appfuse.archetypes:appfuse-basic-spring (2.0.2) +42 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.1)

org.springframework.security:spring-security-core MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.appfuse.archetypes:appfuse-basic-jsf 2.0.2 -...

com.payneteasy.superfly:superfly-web (>=1.2-1, <=1.4-3), org.codehaus.enunciate:enunciate-spring3-security-rt (>=1.20, <=1.22) +15 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.0.2.release)

org.springframework.security:spring-security-core MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.payneteasy.superfly:superfly-web =1.2-1, =1.20,...

org.springframework.security:spring-security-acl (2.0.2), org.springframework.security:spring-security-adapters (2.0.2) +18 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.2)

org.springframework.security:spring-security-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.2 -...

org.apache.camel:camel-example-spring-security (>=2.14.0, <=2.14.4), org.apache.camel:camel-spring-security (>=2.14.0, <=2.14.4) +27 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.7.release)

org.springframework.security:spring-security-core MAVEN version 3.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.camel:camel-example-spring-security =2.14....

com.vnomicscorp:spring-stateless-ticket-cache-redis (1.0.3), org.eobjects.datacleaner:datacleaner-monitor-completeness-analysis-wizard (>=4.0-rc5, <=4.0.9) +10 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.5.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - com.vnomicscorp:spring-stateless-ticket-cache-redis 1.0...

Authentication Bypass Via Null Authentication

spring-security is vulnerable to authentication bypass. The cause of vulnerability is due to the use of PlaintextPasswordEncoder, validating the authentication of a user if a null encoded password is entered...

CVE-2019-11272

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

CVE-2019-11272

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

Design/Logic Flaw

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

CVE-2019-11272

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

CVE-2019-11272

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

CVE-2019-11272 PlaintextPasswordEncoder authenticates encoded passwords that are null

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

CVE-2019-11272

CVE-2019-11272 affects Spring Security where PlaintextPasswordEncoder can allow login with a password of "null" if an encoded password is null. Affected: Spring Security 4.2.x up to 4.2.12 and older unsupported versions. Root cause: using PlaintextPasswordEncoder with null encoded passwords. Impa...

cn.dceast.platform:platform-security-starter (2.2.3), com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.0.114-release) +53 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (>=3.1.0.release, <=4.2.8.release)

org.springframework.security:spring-security-cas MAVEN version =3.1.0.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.0.83-rc1, =1.0.83-rc1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =9.4.0.10, =1.0.0, =1.0.3 and more Source cves: CVE-2019-11272 Source advisory: MEND:CVE-2019-11272...

CVE-2019-11272: Improper Authentication

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

Pivotal Software Spring Security Authentication Vulnerability

Pivotal Software Spring Security is a suite of security frameworks from Pivotal Software, Inc. that provide illustrative security protection for Spring-based applications. A security vulnerability exists in Pivotal Software Spring Security versions 4.2.x through 4.2.12 and older versions that are...