Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in spring-security-core-6.4.5.jar (CVE-2025-41232)

Summary IBM Sterling Control Center is affected by a vulnerability CVE-2025-41232 in spring-security-core-6.4.5.jar. Vulnerability Details CVEID:CVE-2025-41232 DESCRIPTION: Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an...

EUVD-2016-4639

Malware in sbrugna...

EUVD-2010-3545

Malware in sbrugna...

EUVD-2012-4991

Malware in sbrugna...

EUVD-2025-15204

Malicious code in bioql PyPI...

BSAGIoT: a Bayesian Security Aspect Graph for Internet of Things (IoT)

IoT is a dynamic network of interconnected things that communicate and exchange data, where security is a significant issue. Previous studies have mainly focused on attack classifications and open issues rather than presenting a comprehensive overview on the existing threats and vulnerabilities...

GHSA-9PP5-9C7G-4R83 Spring Security authorization bypass for method security annotations on private methods

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: You are using @EnableMethodSecuritymode=ASPECTJ and spring-security-aspects, and You have...

org.coldis.library:persistence (>=2.0.34, <=2.0.38), org.eclipse.hawkbit:hawkbit-ddi-server (>=0.7.0, <=0.8.0) +10 more potentially affected by CVE-2025-41232 via org.springframework.security:spring-security-aspects (>=6.4.1, <=6.4.4)

org.springframework.security:spring-security-aspects MAVEN version =6.4.1, =2.0.34, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.8.0 Source cves: CVE-2025-41232 Source advisory: GHSA-9PP5-9C7G-4R83...

CVE-2025-41232

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: You are using @EnableMethodSecuritymode=ASPECTJ and spring-security-aspects, and You have...

CVE-2025-41232

CVE-2025-41232 affects multiple IBM and Spring-based products where Spring Security Aspects may fail to locate method security annotations on private methods, enabling potential authorization bypass when using @EnableMethodSecurity(mode=ASPECTJ) with spring-security-aspects and private annotated ...

CVE-2025-41232

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: You are using @EnableMethodSecuritymode=ASPECTJ and spring-security-aspects, and You have...

org.coldis.library:persistence (>=2.0.34, <=2.0.38), org.eclipse.hawkbit:hawkbit-ddi-server (>=0.7.0, <=0.8.0) +10 more potentially affected by CVE-2025-41232 via org.springframework.security:spring-security-aspects (>=6.4.1, <=6.4.4)

org.springframework.security:spring-security-aspects MAVEN version =6.4.1, =2.0.34, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.8.0 Source cves: CVE-2025-41232 Source advisory: MEND:CVE-2025-41232...

CVE-2025-41232: Protection Mechanism Failure

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: You are using @EnableMethodSecuritymode=ASPECTJ and spring-security-aspects, and You have...

org.springframework.security:spring-security-acl (3.1.5.release), org.springframework.security:spring-security-aspects (3.1.5.release) +7 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (3.1.5.release)

org.springframework.security:spring-security-core MAVEN version 3.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl...

org.apache.syncope:syncope-core (>=1.0.9, <=1.1.8), org.springframework.security:spring-security-acl (3.1.6.release) +11 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (3.1.6.release)

org.springframework.security:spring-security-core MAVEN version 3.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.syncope:syncope-core =1.0.9, =1.4.9, =1.4....

org.apache.ranger:ranger-kylin-plugin (>=2.3.0, <=2.4.0), org.apache.ranger:ranger-kylin-plugin-shim (>=2.3.0, <=2.4.0) +12 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (4.2.14.release)

org.springframework.security:spring-security-core MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.ranger:ranger-kylin-plugin =2.3.0, =2.3.0...

com.sdl.delivery:udp-service-container-core (>=11.0.0-1078, <=11.0.1-1016), org.apache.atlas:atlas-authorization (2.1.0) +14 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (4.2.16.release)

org.springframework.security:spring-security-core MAVEN version 4.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.sdl.delivery:udp-service-container-core...

com.github.btheu.settesting:spring (0.1.0), org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4) +10 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (3.2.2.release)

org.springframework.security:spring-security-core MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.btheu.settesting:spring 0.1.0 -...

The Windows Registry Adventure #2: A brief history of the feature

Posted by Mateusz Jurczyk, Google Project Zero Before diving into the low-level security aspects of the registry, it is important to understand its role in the operating system and a bit of history behind it. In essence, the registry is a hierarchical database made of named "keys" and "values",...

org.ff4j:ff4j-security-spring (>=1.0.0, <=1.1.0), org.springframework.security:spring-security-acl (3.0.8.release) +7 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.0.8.release)

org.springframework.security:spring-security-core MAVEN version 3.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.ff4j:ff4j-security-spring =1.0.0, =1.1.0 -...