Spring Security PlaintextPasswordEncoder Unauthorized Access

The vulnerability of the PlaintextPasswordEncoder class implementation in the Spring Security Java framework, which is designed for securing industrial applications, is related to deficiencies in managing registration data. Exploiting this vulnerability could allow an attacker, operating remotely...

Important: Red Hat Security Advisory: Red Hat Fuse 7.4.0 security update

A minor version update from 7.3 to 7.4 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

spring-security-core: Unauthorized Access with Spring Security Method Security

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...

spring-security-oauth: Privilege escalation by manipulating saved authorization request

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

Debian DLA-1848-1 : libspring-security-2.0-java security update

Spring Security support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user or attacker can authenticate using a password of 'null'. For...

[SECURITY] [DLA 1848-1] libspring-security-2.0-java security update

Package : libspring-security-2.0-java Version : 2.0.7.RELEASE-3+deb8u2 CVE ID : CVE-2019-11272 Spring Security support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null...

Security Bulletin: Remote code execution vulnerability (CVE-2019-11269) affects IBM Spectrum Symphony 7.2.1 and 7.2.0.2

Summary A remote code execution vulnerability exists in the Spring Security OAuth version used by IBM Spectrum Symphony 7.2.1 and 7.2.0.2. Interim fixes that provide instructions on upgrading the Spring Security OAuth package to version 2.0.18 which resolves this vulnerability are available on IB...

com.github.dblock.waffle:waffle-spring-security3 (>=1.5, <=1.6), com.paddypowerbetfair.springframework:spring-security-saml-keys-rollover (1.0.2) +45 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.2.release)

org.springframework.security:spring-security-core MAVEN version 3.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security3 =1.5...

Insufficiently Protected Credentials and Improper Authentication in Spring Security

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

GHSA-V33X-PRHC-GPH5 Insufficiently Protected Credentials and Improper Authentication in Spring Security

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user ...

org.eobjects.datacleaner:datacleaner-completeness-analysis-wizard (>=3.5.9, <=3.7.4), org.eobjects.datacleaner:datacleaner-copy-data-wizard (>=3.5.9, <=3.7.4) +18 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.1.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: -...

org.jasig.cas:cas-server-webapp (>=3.5.0-rc1, <=3.6.0) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.0.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.jasig.cas:cas-server-webapp =3.5.0-rc1, =3.6.0 Sour...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.github.yongjacky:jee.borneo.miri (1.1.6) +111 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.4.release)

org.springframework.security:spring-security-core MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - be.dnsbelgium:rdap-server =0.3.3, =1.6-2, =1.6.0,...

com.sitewhere:sitewhere-activemq (>=1.0.2, <=1.4.0), com.sitewhere:sitewhere-azure (>=1.0.2, <=1.4.0) +68 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.6.release)

org.springframework.security:spring-security-core MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.sitewhere:sitewhere-activemq =1.0.2, =1.0.2,...

com.myjeeva:spring-extensions (>=1.0.0, <=1.0.1), org.springframework.security:spring-security-acl (2.0.6.release) +6 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.6.release)

org.springframework.security:spring-security-core MAVEN version 2.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.myjeeva:spring-extensions =1.0.0, =1.0.1 -...

co.paralleluniverse:comsat-spring-security (0.3.0), com.bq.corbel:oauth-server (>=1.31.1, <=1.35.0) +289 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.5.release)

org.springframework.security:spring-security-core MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - co.paralleluniverse:comsat-spring-security 0.3.0 -...

at.molindo.social:spring-social-security (1.1.4.release), com.foreach.across.modules:admin-web-module (1.1.1.release) +90 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.9.release)

org.springframework.security:spring-security-core MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - at.molindo.social:spring-social-security 1.1.4.releas...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-acl (3.0.1.release) +13 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.0.1.release)

org.springframework.security:spring-security-core MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

com.allanditzel:spring-security-csrf-token-filter (1.1), com.btmatthews.atlas:atlas-jcr (1.0.1) +140 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.0.release)

org.springframework.security:spring-security-core MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.allanditzel:spring-security-csrf-token-filter 1.1...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11), ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7) +2345 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (>=4.0.0.release, <=4.2.12.release)

org.springframework.security:spring-security-core MAVEN version =4.0.0.release, =0.1.8, =0.1.6, =0.1.4-sb1x, =1.0.0, =1.0.0, =1.0.0, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 and more Source cves: CVE-2019-11272 Source advisory:...