am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +662 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=2.0.16.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0.release, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2019-3778 Source advisory: MEND:CVE-2019-3778...

br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +69 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +286 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.4.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =1.0.0, =1.0.6, =1.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2019-3778 Source advisory: MEND:CVE-2019-3778...

CVE-2019-3778

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2019-3778 Open Redirect in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

com.alexbt:springboot-autoconfigure-openid-oauth (1.0.9), com.appdirect:service-integration-sdk (>=v1-2.0.2, <=2.0.2) +15 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth (>=2.0.1.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth MAVEN version =2.0.1.release, =v1-2.0.2, =2.2.4, =2.2.4, =2.7.4, =2.2.4, =2.2.4, =3.0.0, =2.7.4, =2.2.4, =3.0.0, =2.2.4, =2.5.2, =0.4.3, =0.4.42 and more Source cves: CVE-2019-3778 Source advisory: MEND:CVE-2019-3778...

Authorization

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2019-3778

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2019-3778

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2019-3778: URL Redirection to Untrusted Site

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

PT-2019-5715

Name of the Vulnerable Software and Affected Versions Spring Security OAuth versions 2.0 through 2.3.4 Spring Security OAuth version 2.3.5 and later are not affected, but versions prior to 2.3.5 are vulnerable. Description The issue is related to an open redirector attack that can leak an...

Open Redirection

spring-security-oauth2 is vulnerable to open redirection. A lack of validation on the redirecturi parameter allows an attacker to manipulate the redirect URI by sending a malicious request to the authorization endpoint using the authorization code grant type and cause the authorization server to...

Open Redirector in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.5 , and 2.2 prior to 2.2.4 , and 2.1 prior to 2.1.4 , and 2.0 prior to 2.0.17 , and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request t...

GHSA-27XW-P8V6-9JJR Spring Security vulnerable to Authorization Bypass

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWT...

Spring Security vulnerable to Authorization Bypass

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWT...

ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.1.6), co.abit.api.core:core-security (>=1.1.1, <=1.1.4) +235 more potentially affected by CVE-2018-15801 via org.springframework.security:spring-security-core (>=5.1.0.release, <=5.1.1.release)

org.springframework.security:spring-security-core MAVEN version =5.1.0.release, =0.1.2, =1.1.1, =1.1.1, =2.3.3, =2018.9.23, =2018.9.23, =2018.9.23, =2018.11.16 - com.holon-platform.core:documentation-core 5.2.0-alpha2 - com.holon-platform.core:holon-spring-security 5.2.0-alpha2 and more Source...

com.microsoft.azure:azure-active-directory-b2c-spring-boot-starter (>=2.1.4.m1, <=2.1.6.m2), com.sap.cloud.security.xsuaa:spring-xsuaa (>=1.1.0.rc1, <=2.1.0) +4 more potentially affected by CVE-2018-15801 via org.springframework.security:spring-security-oauth2-jose (5.1.1.release)

org.springframework.security:spring-security-oauth2-jose MAVEN version 5.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: -...

ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.1.6), co.abit.api.core:core-security (>=1.1.1, <=1.1.4) +235 more potentially affected by CVE-2018-15801 via org.springframework.security:spring-security-core (>=5.1.0.release, <=5.1.1.release)

org.springframework.security:spring-security-core MAVEN version =5.1.0.release, =0.1.2, =1.1.1, =1.1.1, =2.3.3, =2018.9.23, =2018.9.23, =2018.9.23, =2018.11.16 - com.holon-platform.core:documentation-core 5.2.0-alpha2 - com.holon-platform.core:holon-spring-security 5.2.0-alpha2 and more Source...

com.microsoft.azure:azure-active-directory-b2c-spring-boot-starter (>=2.1.4.m1, <=2.1.6.m2), com.sap.cloud.security.xsuaa:spring-xsuaa (>=1.1.0.rc1, <=2.1.0) +4 more potentially affected by CVE-2018-15801 via org.springframework.security:spring-security-oauth2-jose (5.1.1.release)

org.springframework.security:spring-security-oauth2-jose MAVEN version 5.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: -...

CVE-2018-15801

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWT...