com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +34 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.2.4.release)

org.springframework.security:spring-security-web MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

com.malliina:mobile-push_2.12 (1.12.5), com.malliina:play-social_2.12 (>=4.12.3, <=4.13.0) +4 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (5.12)

com.nimbusds:nimbus-jose-jwt MAVEN version 5.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.malliina:mobile-push2.12 1.12.5 - com.malliina:play-social2.12 =4.12.3, =4.12.3, =0.0.11, =0.0.12 -...

cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.10) +385 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.13)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =2.0rc1, =2.0rc1,...

com.sap.cloud.lm.sl.cf:com.sap.cloud.lm.sl.cf.client (>=1.73.40, <=1.73.47), com.sap.cloud.lm.sl.cf:com.sap.cloud.lm.sl.cf.core (>=1.73.40, <=1.73.47) +60 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-oauth2-client (>=5.8.0, <=5.8.15)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.8.0, =1.73.40, =1.73.40, =1.73.40, =1.73.40, =1.0.65, =11.3.0, =3.1.0, =3.1.0, =2.1.13, =2.1.13, =2.1.13, =2.1.13, =2.1.13, =2.1.13, =2.1.25 and more Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

RHEL 7 / 8 : OpenShift Container Platform 4.10.56 (RHSA-2023:1655)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1655 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +48 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.2.4.release)

org.springframework.security:spring-security-core MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

Important: Red Hat Security Advisory: Migration Toolkit for Runtimes security bug fix and enhancement update

Migration Toolkit for Runtimes 1.0.2 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Privilege Escalation

Spring Security OAuth2 Client is vulnerable to Privilege Escalation. The vulnerability exists in the getTokenResponse function in multiple files due to the authorization server responding with an OAuth2 access token response containing an empty scope list which allows an attacker to modify reques...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +573 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.0.4.release, <=5.6.8)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.0.4.release, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.1, =0.3 - cn.itlym:shoulder-security-code 0.3 - cn.itlym:shoulder-starter-auth-server 0.3 -...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +573 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.0.4.release, <=5.6.8)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.0.4.release, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.1, =0.3 - cn.itlym:shoulder-security-code 0.3 - cn.itlym:shoulder-starter-auth-server 0.3 -...

cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.0) +216 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =0.1.40 - com.graphql-java-generator:graphql-java-client-dependencies 1.18.8 - com.graphql-java-generator:graphql-java-client-runtime...

cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.0) +216 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =0.1.40 - com.graphql-java-generator:graphql-java-client-dependencies 1.18.8 - com.graphql-java-generator:graphql-java-client-runtime...

cn.kduck:kduck-security-principal (1.1.3), com.atlassian.connect:atlassian-connect-spring-boot-core (>=3.0.0-beta-1, <=3.0.0) +216 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.7.1, <=5.7.4)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.7.1, =3.0.0-beta-1, =3.0.0-beta-1, =4.3.0, =5.1.3, =5.1.3, =5.1.0, =4.2.0, =0.1.33, =0.1.40 - com.graphql-java-generator:graphql-java-client-dependencies 1.18.8 - com.graphql-java-generator:graphql-java-client-runtime...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +573 more potentially affected by CVE-2022-31690 via org.springframework.security:spring-security-oauth2-client (>=5.0.4.release, <=5.6.8)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.0.4.release, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.0.3-alpha, =0.1, =0.3 - cn.itlym:shoulder-security-code 0.3 - cn.itlym:shoulder-starter-auth-server 0.3 -...

Denial Of Service (DoS)

org.springframework.security:spring-security-oauth2-client is vulnerable to denial of service DoS attacks. An attacker is able to cause resource exhaustion via sending multiple requests initiating the authorization request for the authorization code grant using a single session or multiple...

com.nortal.jroad.starter:j-road-client (0.3.0), com.nortal.jroad.starter:j-road-server (0.3.0) +19 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.0.19.release)

org.springframework:spring-web MAVEN version 5.0.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.nortal.jroad.starter:j-road-client 0.3.0 - com.nortal.jroad.starter:j-road-server 0.3....

com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +48 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.2.4.release)

org.springframework.security:spring-security-core MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +100 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (>=5.2.0.release, <=5.2.9.release)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.2.0.release, =2.0.0, =1.0.0, =5.0.0, =0.0.3, =0.1.0, =0.1.0, =0.2, =0.2, =0.3 and more Source cves: CVE-2021-22119 Source advisory: GHSA-W9JG-GVGR-354M...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +100 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (>=5.2.0.release, <=5.2.9.release)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.2.0.release, =2.0.0, =1.0.0, =5.0.0, =0.0.3, =0.1.0, =0.1.0, =0.2, =0.2, =0.3 and more Source cves: CVE-2021-22119 Source advisory: OSV:GHSA-W9JG-GVGR-354M...

cn.itlym:shoulder-security (0.3), cn.itlym:shoulder-security-code (0.3) +233 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (>=5.3.1.release, <=5.3.9.release)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.3.1.release, =3.0.0-beta.1, =2.2.0, =2.0, =1.0.0, =2.3.1, =6.20.1, =6.6.33, =3.0.0.release, =4.0.8.release and more Source cves: CVE-2021-22119 Source advisory: OSV:GHSA-W9JG-GVGR-354M...