Authentication flaw

Broken Authentication in Atlassian Connect Spring Boot ACSB in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Sprin...

CVE-2021-26077

Broken Authentication in Atlassian Connect Spring Boot ACSB in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Sprin...

CVE-2021-26077

Atlassian Connect Spring Boot (ACSB) has a Broken Authentication issue in affected versions: 1.1.0 to 2.1.3 and 2.1.4 to 2.1.5. The root cause is acceptance of context JWTs in lifecycle endpoints (e.g., installation) where server-to-server JWTs are required, enabling authenticated re-installation...

CVE-2021-26077

Broken Authentication in Atlassian Connect Spring Boot ACSB in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Sprin...

PT-2021-16944 · Atlassian · Connect Spring Boot

Name of the Vulnerable Software and Affected Versions: Atlassian Connect Spring Boot versions 1.1.0 through 2.1.3 Atlassian Connect Spring Boot versions 2.1.4 through 2.1.5 Description: The issue concerns Atlassian Connect Spring Boot, a Java Spring Boot package for building Atlassian Connect app...

Atlassian Connect Spring Boot 授权问题漏洞

Atlassian Connect Spring Boot is an application component from Atlassian Australia. A Spring Boot starter program is provided for building Atlassian Connect add-ons for JIRA Software, Service Desk and Core and Confluence. An authorization issue vulnerability exists in Atlassian Connect Spring Boo...

Improper Authentication in Apache Shiro

Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

GHSA-26GR-CVQ3-QXGF Improper Authentication in Apache Shiro

Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

GHSA-72W9-FCJ5-3FCG Improper Authentication in Apache Shiro

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

Improper Authentication in Apache Shiro

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass...

Improper Input Validation in Spring Framework

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

com.github.mswolfe:spring-query-filter (>=4.2.0 <=4.3.2), io.github.cyjishuang:swagger-mode (=1.0) potentially affected by CVE-2020-5421 via org.springframework:spring-framework-bom (>=4.2.3.RELEASE <=4.3.14.RELEASE)

org.springframework:spring-framework-bom MAVEN version =4.2.3.RELEASE, =4.2.0, =4.3.2 - io.github.cyjishuang:swagger-mode =1.0 Source cves: CVE-2020-5421 Source advisory: OSV:GHSA-RV39-3QH7-9V7W...

GHSA-RV39-3QH7-9V7W Improper Input Validation in Spring Framework

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

cn.felord:payment-spring-boot-starter (>=1.0.0.RELEASE <=1.0.10.RELEASE), cn.hermesdi:api-crypto-spring-boot-starter (>=1.0.0 <=1.0.0.RELEASE) +150 more potentially affected by CVE-2020-28052 via org.bouncycastle:bcprov-jdk15to18 (>=1.65 <=1.66)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.65, =1.0.0.RELEASE, =1.0.0, =1.5.1, =2.0.0, =0.7.7, =0.7.7, =0.7.7, =0.7.7, =0.0.1, =0.0.1, =1.0.0, =5.23.1, =5.24.6 and more Source cves: CVE-2020-28052 Source advisory: OSV:GHSA-73XV-W5GP-FRXH...

cc.cc4414:cc-spring-cloud-starter (>=0.3.0 <=0.8.0), cc.cc4414:cc-spring-cloud-starter-gateway (>=0.5.0 <=0.8.0) +436 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (>=0.1.0 <=1.4.0)

com.alibaba.nacos:nacos-common MAVEN version =0.1.0, =0.3.0, =0.5.0, =1.0.0, =1.1, =1.1, =0.0.2, =0.0.2, =1.0.8, =1.4.0, =2021.6.0 - cn.iisme.cloud:iisme-demos-nacos-core =1.0.1 - cn.iisme.cloud:iisme-demos-nacos-web =1.0.1 - cn.iisme.cloud:iisme-gateway-nacos =1.0.1 -...

Moderate: Red Hat Security Advisory: Red Hat Fuse 7.8.1 patch release and security update

A micro version update from 7.8.0 to 7.8.1 is now available for Red Hat Fuse on Karaf and Red Hat Fuse on Spring Boot 2. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impac...

org.smartboot.flow:smart-flow-admin (>=1.0.8 <=1.1.4), org.smartboot.servlet:smart-servlet-maven-plugin (>=0.1.9 <=0.6) +1 more potentially affected by CVE-2021-29425 via org.smartboot.servlet:servlet-core (>=0.1.9 <=0.6)

org.smartboot.servlet:servlet-core MAVEN version =0.1.9, =1.0.8, =0.1.9, =0.1.9, =0.6 Source cves: CVE-2021-29425 Source advisory: OSV:GHSA-GWRP-PVRQ-JMWV...

CVE-2021-31408

Authentication.logout helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 Vaadin 18, and 6.0.0 through 6.0.4 Vaadin 19.0.0 through 19.0.3 uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the...

Cross site request forgery (csrf)

Authentication.logout helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 Vaadin 18, and 6.0.0 through 6.0.4 Vaadin 19.0.0 through 19.0.3 uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the...

cc.eamon.open:auth (=0.0.2), cn.easyproject:easyshiro-redis-cache (=2.6.0-RELEASE) +770 more potentially affected by CVE-2020-17510 via org.apache.shiro:shiro-spring (>=1.0.0-incubating <=1.6.0)

org.apache.shiro:shiro-spring MAVEN version =1.0.0-incubating, =1.0, =1.0, =1.0.0, =1.0.4 - cn.org.awcp:awcp-formdesigner-applicationImpl =1.0-RELEASE - cn.org.awcp:awcp-metadesigner-applicationImpl =1.0-RELEASE - cn.org.awcp:awcp-unit-application =1.0-RELEASE and more Source cves: CVE-2020-17510...