Lucene search
+L

1283 matches found

NCSC
NCSC
added 2022/11/04 12:0 a.m.32 views

Vulnerabilities fixed in VMware Spring

VMware has fixed vulnerabilities in Spring Security and spring-security-oauth2-client. A malicious party could vulnerabilities potentially exploit them to obtain elevated privileges or to bypass authentication. Only Spring environments using specific configurations are vulnerable. VMware has...

9.8CVSS7AI score0.03429EPSS
SaveExploits3
GithubExploit
GithubExploit
added 2022/11/03 8:35 a.m.689 views

Exploit for Authorization Bypass Through User-Controlled Key in Vmware Spring_Security

CVE-2022-31692 Demo Overview A simple Spring Boot applicat...

9.8CVSS9.5AI score0.03429EPSS
SaveExploits3
hivepro
hivepro
added 2022/11/02 7:10 a.m.19 views

Privilege Escalation in VMware spring-security

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A vulnerability in VMwares Spring Security affects the mapping of permitted scope in spring-security-oauth2-client, allowing privilege escalation...

3.1AI score
SaveExploits0
vulnersOsv
vulnersOsv
added 2022/11/01 12:0 p.m.9 views

au.csiro.pathling:fhir-server (>=5.3.1 <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0 <=2.4.1) +2396 more potentially affected by CVE-2022-31692 via org.springframework.security:spring-security-core (>=5.7.0 <=5.7.4)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java =2.6.0 - be.jidoka:jdk-keycloak-admin =1.3.0 - br.com.m4rc310:br-com-m4rc310-graphql =1.0.1 - br.com.m4rc310:br-com-m4rc310-libs =1.0.1 -...

9.8CVSS6.7AI score0.03429EPSS
SaveExploits3
vulnersOsv
vulnersOsv
added 2022/11/01 12:0 p.m.11 views

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (=3.1.0.RELEASE), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (=3.1.0.RELEASE) +572 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.0.10.RELEASE <=5.6.8)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.0.10.RELEASE, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.1, =0.3 - cn.itlym:shoulder-security-code =0.3 - cn.itlym:shoulder-starter-auth-server =0.3 -...

8.1CVSS7.2AI score0.01039EPSS
SaveExploits0
Github Security Blog
Github Security Blog
added 2022/11/01 12:0 p.m.45 views

spring-security-oauth2-client vulnerable to Privilege Escalation

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

8.1CVSS8.3AI score0.01039EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2022/11/01 12:0 p.m.7 views

GHSA-MMMH-WCXM-2WR4 Spring Security authorization rules can be bypassed via forward or include dispatcher types

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

9.8CVSS6.7AI score0.03429EPSS
SaveExploits3References4
vulnersOsv
vulnersOsv
added 2022/11/01 12:0 p.m.15 views

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2 <=4.6.0.0), ai.ylyue:yue-library-auth-client (>=j11.2.6.0 <=j11.2.6.1) +1921 more potentially affected by CVE-2022-31692 via org.springframework.security:spring-security-core (>=5.6.0 <=5.6.8)

org.springframework.security:spring-security-core MAVEN version =5.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =1.3.1.RELEASE, =0.2.0, =0.8.3, =2.1.0.M8, =1.0.0, =2.7.0.Beta3, =2.7.0.Beta4, =2.7.0.Beta3, =2.7.0.Beta3, =2.7.0.Beta3, =2.7.0.RC1 and more Source cves: CVE-2022-31692 Source advisory:...

9.8CVSS6.7AI score0.03429EPSS
SaveExploits3
vulnersOsv
vulnersOsv
added 2022/11/01 12:0 p.m.10 views

cn.kduck:kduck-security-principal (=1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0 <=3.0.10) +338 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1 <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0, =3.0.0, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =1.18.8, =1.18.8, =2.9 - com.graphql-java-generator:graphql-maven-plugin =1.18.8 and more Source cves: CVE-2022-31690https://vulners.com/cve/CVE-2...

8.1CVSS7.2AI score0.01039EPSS
SaveExploits0
OSV
OSV
added 2022/11/01 12:0 p.m.8 views

GHSA-32VJ-V39G-JH23 spring-security-oauth2-client vulnerable to Privilege Escalation

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

8.1CVSS5.9AI score0.01039EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2022/11/01 12:0 p.m.41 views

Spring Security authorization rules can be bypassed via forward or include dispatcher types

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

9.8CVSS8.9AI score0.03429EPSS
SaveExploits3References4Affected Software1
NVD
NVD
added 2022/10/31 8:15 p.m.45 views

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

8.1CVSS0.01039EPSS
SaveExploits0References2
NVD
NVD
added 2022/10/31 8:15 p.m.28 views

CVE-2022-31692

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

9.8CVSS0.03429EPSS
SaveExploits3References2
UbuntuCve
UbuntuCve
added 2022/10/31 8:15 p.m.39 views

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

8.1CVSS7.2AI score0.01039EPSS
SaveExploits0References2
OSV
OSV
added 2022/10/31 8:15 p.m.17 views

UBUNTU-CVE-2022-31692

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

9.8CVSS6.7AI score0.03429EPSS
SaveExploits3References3
Prion
Prion
added 2022/10/31 8:15 p.m.35 views

Authorization

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies...

7.5CVSS9.2AI score0.03429EPSS
SaveExploits3References2Affected Software1
Prion
Prion
added 2022/10/31 8:15 p.m.36 views

Authorization

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

5.1CVSS8.7AI score0.01039EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2022/10/31 8:15 p.m.9 views

UBUNTU-CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

8.1CVSS7.2AI score0.01039EPSS
SaveExploits0References3
Spring Security Advisories
Spring Security Advisories
added 2022/10/31 4:41 p.m.245 views

CVE-2022-31690: Privilege Escalation in spring-security-oauth2-client

Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31690 affecting the mapping of authorized scopes in spring-security-oauth2-client. Users are encouraged to update as soon as possible. Impact Users who have applied the mitigation should take note of the...

0.7AI score0.01039EPSS
SaveExploits0
Spring Security Advisories
Spring Security Advisories
added 2022/10/31 4:41 p.m.196 views

CVE-2022-31692: Authorization rules can be bypassed via forward or include in Spring Security

Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31692 affecting the AuthorizationFilter. Users are encouraged to update as soon as possible...

4.5AI score0.03429EPSS
SaveExploits3
Rows per page
Query Builder