au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +1877 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-config (>=5.7.0, <=5.7.13)

org.springframework.security:spring-security-config MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 - br.com.m4rc310:br-com-m4rc310-starter 1.0.1 -...

cc.chensoul.nacos:nacos-distribution (2.5.2), com.buession.security:buession-security-spring (>=3.0.0, <=3.0.1) +316 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.15)

org.springframework.security:spring-security-config MAVEN version =5.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.11.0, =5.11.0, =1.48.0, =1.48.0, =1.48.0, =4.5.0, =4.5.0, =4.5.0, =6.5.0, =4.5.0, =4.5.1 and more Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11), am.ik.home:uaa-client (>=1.3.0, <=1.9.0) +1136 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-config (>=4.2.0.release, <=4.2.20.release)

org.springframework.security:spring-security-config MAVEN version =4.2.0.release, =0.1.8, =1.3.0, =1.3.0, =1.3.0, =0.3, =1.1.1, =0.0.1, =0.2.0, =1.0.3, =1.0.5, =0.0.1, =1.0.1.u1 and more Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

PT-2024-16054 · Safenet · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG version 5 Description: A critical issue was found in the function actionDelNetSecConfig of the file /com/esafenet/servlet/netSec/NetSecConfigService.java. The manipulation of the argument id leads to SQL injection. It is possible...

Security Bulletin: IBM Spectrum Symphony with spring-security-config is vulnerable to Incorrect Permission Assignment for Critical Resource

Summary IBM Spectrum Symphony with spring-security-config is vulnerable to Incorrect Permission Assignment for Critical Resource Vulnerability Details CVEID:CVE-2023-34042 DESCRIPTION: VMware Tanzu Spring Security could allow a local authenticated attacker to bypass security restrictions, caused ...

Security Bulletin: IBM Spectrum Conductor with spring-security-config is vulnerable to Incorrect Permission Assignment for Critical Resource

Summary IBM Spectrum Conductor with spring-security-config is vulnerable to Incorrect Permission Assignment for Critical Resource Vulnerability Details CVEID:CVE-2023-34042 DESCRIPTION: VMware Tanzu Spring Security could allow a local authenticated attacker to bypass security restrictions, caused...

com.payneteasy.superfly:superfly-web (>=1.2-1, <=1.4-3), org.codehaus.enunciate:enunciate-spring3-security-rt (>=1.20, <=1.22) +15 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.0.2.release)

org.springframework.security:spring-security-core MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.payneteasy.superfly:superfly-web =1.2-1, =1.20,...

org.ff4j:ff4j-security-spring (>=1.0.0, <=1.1.0), org.springframework.security:spring-security-acl (3.0.8.release) +7 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.0.8.release)

org.springframework.security:spring-security-core MAVEN version 3.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.ff4j:ff4j-security-spring =1.0.0, =1.1.0 -...

com.github.btheu.settesting:spring (0.1.0), org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4) +10 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.2.2.release)

org.springframework.security:spring-security-core MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.btheu.settesting:spring 0.1.0 -...

org.apache.ranger:ranger-kylin-plugin (>=2.3.0, <=2.4.0), org.apache.ranger:ranger-kylin-plugin-shim (>=2.3.0, <=2.4.0) +12 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.14.release)

org.springframework.security:spring-security-core MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.ranger:ranger-kylin-plugin =2.3.0, =2.3.0...

com.epam.reportportal:service-authorization (>=5.11.0, <=5.11.1), com.erudika:para-jar (1.49.0) +51 more potentially affected by CVE-2023-34042 via org.springframework.security:spring-security-config (>=5.8.4, <=5.8.6)

org.springframework.security:spring-security-config MAVEN version =5.8.4, =5.11.0, =1.73.40, =1.73.40, =1.73.40, =1.73.40, =2.35.0, =2.14.0, =2.14.0, =11.3.6, =11.3.6, =11.3.6, =11.3.6, =11.4.2 and more Source cves: CVE-2023-34042 Source advisory: GHSA-9GP8-6CG8-7H34...

com.almis.awe:awe-annotation (>=4.7.1, <=4.7.7), com.almis.awe:awe-annotations-spring-boot-starter (>=4.7.1, <=4.7.7) +28 more potentially affected by CVE-2023-34042 via org.springframework.security:spring-security-config (>=6.0.4, <=6.0.6)

org.springframework.security:spring-security-config MAVEN version =6.0.4, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.7 - com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter 4.0.0-m1 and more Source cves:...

au.csiro.pathling:fhir-server (>=6.2.2, <=6.3.1), cc.hiver:hiver-core (>=1.0, <=1.0.4) +208 more potentially affected by CVE-2023-34042 via org.springframework.security:spring-security-config (>=5.7.9, <=5.7.10)

org.springframework.security:spring-security-config MAVEN version =5.7.9, =6.2.2, =1.0, =2.7.13.0, =2.7.14.0, =2.7.13.0, =2.7.14.0, =2.7.13.0, =1.0.1, =1.2.1.release - cn.structured:structure-oauth-common 1.0.1 - cn.structured:structure-oauth-resource-starter 1.0.1 -...

com.epam.reportportal:service-authorization (>=5.11.0, <=5.11.1), com.erudika:para-jar (1.49.0) +51 more potentially affected by CVE-2023-34042 via org.springframework.security:spring-security-config (>=5.8.4, <=5.8.6)

org.springframework.security:spring-security-config MAVEN version =5.8.4, =5.11.0, =1.73.40, =1.73.40, =1.73.40, =1.73.40, =2.35.0, =2.14.0, =2.14.0, =11.3.6, =11.3.6, =11.3.6, =11.3.6, =11.4.2 and more Source cves: CVE-2023-34042 Source advisory: OSV:GHSA-9GP8-6CG8-7H34...

com.almis.awe:awe-annotation (>=4.7.1, <=4.7.7), com.almis.awe:awe-annotations-spring-boot-starter (>=4.7.1, <=4.7.7) +28 more potentially affected by CVE-2023-34042 via org.springframework.security:spring-security-config (>=6.0.4, <=6.0.6)

org.springframework.security:spring-security-config MAVEN version =6.0.4, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.1, =4.7.7 - com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter 4.0.0-m1 and more Source cves:...

au.csiro.pathling:fhir-server (>=6.2.2, <=6.3.1), cc.hiver:hiver-core (>=1.0, <=1.0.4) +208 more potentially affected by CVE-2023-34042 via org.springframework.security:spring-security-config (>=5.7.9, <=5.7.10)

org.springframework.security:spring-security-config MAVEN version =5.7.9, =6.2.2, =1.0, =2.7.13.0, =2.7.14.0, =2.7.13.0, =2.7.14.0, =2.7.13.0, =1.0.1, =1.2.1.release - cn.structured:structure-oauth-common 1.0.1 - cn.structured:structure-oauth-resource-starter 1.0.1 -...

cn.herodotus.engine:oauth2-sdk-authentication (>=3.1.1.0, <=3.1.4.3), cn.herodotus.engine:oauth2-sdk-authorization (>=3.1.1.0, <=3.1.4.3) +321 more potentially affected by CVE-2023-34042 via org.springframework.security:spring-security-config (>=6.1.1, <=6.1.3)

org.springframework.security:spring-security-config MAVEN version =6.1.1, =3.1.1.0, =3.1.1.0, =3.1.1.0, =3.1.1.0, =5.5.0, =5.5.0, =0.0.9, =0.0.12, =0.0.30, =0.0.42, =6.1.16, =6.1.16, =7.0.0, =7.1.8 and more Source cves: CVE-2023-34042 Source advisory: GHSA-9GP8-6CG8-7H34...

cn.herodotus.engine:oauth2-sdk-authentication (>=3.1.1.0, <=3.1.4.3), cn.herodotus.engine:oauth2-sdk-authorization (>=3.1.1.0, <=3.1.4.3) +321 more potentially affected by CVE-2023-34042 via org.springframework.security:spring-security-config (>=6.1.1, <=6.1.3)

org.springframework.security:spring-security-config MAVEN version =6.1.1, =3.1.1.0, =3.1.1.0, =3.1.1.0, =3.1.1.0, =5.5.0, =5.5.0, =0.0.9, =0.0.12, =0.0.30, =0.0.42, =6.1.16, =6.1.16, =7.0.0, =7.1.8 and more Source cves: CVE-2023-34042 Source advisory: OSV:GHSA-9GP8-6CG8-7H34...

Design/Logic Flaw

The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical...

CVE-2023-34042

The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical...