Security Bulletin: IBM Engineering Requirements Management DOORS Next for J2EE File Disclosure Rule (CVE-2024-41786)

Summary IBM Engineering Requirements Management DOORS Next could allow an attacker to access sensitive files and application resources due to improper validation of user-controlled input in server-side forward/include operations. An attacker could exploit this vulnerability to view configuration...

spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security

A flaw was found in the spring-security framework. Spring Security could allow a remote attacker to bypass security restrictions caused by an issue when using forward or include dispatcher types. By sending a specially-crafted request, an attacker can bypass authorization rules...

Authorization rules can be bypassed via forward or include dispatcher types in Spring Security

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: An application is not vulnerable if any of the following i...