CVE-2014-3527

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...

CVE-2014-0097

The CVE affects Spring Security’s ActiveDirectoryLdapAuthenticator (versions 3.2.0–3.2.1 and 3.1.0–3.1.5). It does not enforce password length, which can allow authentication of a user with an empty password if the directory permits anonymous binds. This is the stated vulnerability and its impact...

CVE-2014-3527

The CVE-2014-3527 issue affects Spring Security’s CAS Proxy ticket authentication (versions 3.1 to 3.2.4). The root cause is that the proxy ticket authentication relies on HttpServletRequest data that can be populated from untrusted information, enabling a malicious CAS service to bypass access c...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.arsframework:ars-module-cms (>=1.0.0, <=1.1.4) +379 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.4.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =0.3.3, =1.0.0, =1.0.0, =1.0.0, =1.2.1, =1.2.1, =1.3.6, =1.0.0-alpha2, =1.5, =1.0.0, =3.0.4, =3.0.5 - com.github.ptomli.bedrock:bedrock-core 1.0.0 - com.github.yongjacky:jee.borneo.miri 1.1.6 -...

com.aerse:gcless (11.2), com.aerse:spring-security-taglib (1.1) +239 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.2.0.release, <=3.2.1.release)

org.springframework.security:spring-security-core MAVEN version =3.2.0.release, =0.0.1, =3.4, =3.0.0, =1.0.50, =1.0.52 - com.microsoftopentechnologies:windows-azure-storage-plugin 0.3.1 and more Source cves: CVE-2014-0097 Source advisory: MEND:CVE-2014-0097...

CVE-2016-5007

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space...

CVE-2016-5007

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space...

CVE-2016-5007

CVE-2016-5007 affects Spring Security (3.2.x, 4.0.x, 4.1.0) and Spring Framework (3.2.x, 4.0.x, 4.1.x, 4.2.x). The root cause is differences in URL pattern matching/space trimming that can cause some paths to be treated as protected when they should not be, due to varying pattern matching between...

CVE-2016-4977

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 are vulnerable to remote code execution (RCE) . The root cause is that the response_type parameter value is executed as Spring SpEL when processing authorization requests using whitelabel views . A malicious user can craft this para...

CVE-2016-4977

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

CVE-2014-0097

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password...

CVE-2016-5007

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space...

CVE-2016-4977

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

Security fix for the ALT Linux 7 package samba version 4.5.10-alt1.M70P.1

4.5.10-alt1.M70P.1 built May 25, 2017 Evgeny Sinelnikov in task 183302 May 24, 2017 Evgeny Sinelnikov - Update to second spring security release - Fix longtime initialization bug in ldb proxy - Security fixes: + CVE-2017-7494 Remote code execution from a writable share...

CVE-2016-4977: Undefined Security Weakness

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

CVE-2014-0097: Improper Authentication

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password...

CVE-2016-5007: Undefined Security Weakness

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space...

PT-2017-5875

Name of the Vulnerable Software and Affected Versions: Spring Security versions 3.1 through 3.2.4 Description: A malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated, due to the proxy ticket authentication using information from the...

CVE-2014-3527: Improper Authentication

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...

PT-2017-8646

Name of the Vulnerable Software and Affected Versions Spring Security versions 3.2.x through 4.1.0 Spring Framework versions 3.2.x through 4.2.x Description The issue arises from differences in the strictness of URL pattern matching mechanisms between Spring Security and the Spring Framework, whi...