br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +57 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +85 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.0.0.release, =3.1.0.release and more Source cves: CVE-2018-15758 Source advisory: MEND:CVE-2018-15758...

GHSA-7Q9C-H23X-65FQ Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +5 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.1, =1.0.1, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 Source cves: CVE-2016-4977 Source advisory: OSV:GHSA-7Q9C-H23X-65FQ...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +5 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.1, =1.0.1, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 Source cves: CVE-2016-4977 Source advisory: GHSA-7Q9C-H23X-65FQ...

cn.bestwu:api-sign (>=1.0.0, <=1.0.1), cn.bestwu:security-oauth2-authorizationserver (1.0.0) +184 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.9.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.31.1, =3.1.1, =1.0.0.release, =0.1, =5.2.2, =1.2.0, =3.1.1, =0.1, =1.0.1.release, =1.0, =1.2.3 and more Source cves: CVE-2016-4977 Source advisory: OSV:GHSA-7Q9C-H23X-65FQ...

cn.bestwu:api-sign (>=1.0.0, <=1.0.1), cn.bestwu:security-oauth2-authorizationserver (1.0.0) +184 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.9.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.31.1, =3.1.1, =1.0.0.release, =0.1, =5.2.2, =1.2.0, =3.1.1, =0.1, =1.0.1.release, =1.0, =1.2.3 and more Source cves: CVE-2016-4977 Source advisory: GHSA-7Q9C-H23X-65FQ...

br.com.damsete.arq:damsete-arq (>=0.0.1, <=0.0.3), br.com.damsete.arq:damsete-arq-audit (>=0.0.1, <=0.0.3) +14 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.1.release, =4.0.0, =0.1.0, =4.26.0, =4.26.0, =3.3.0.6, =4.30.0 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

br.com.damsete.arq:damsete-arq (>=0.0.1, <=0.0.3), br.com.damsete.arq:damsete-arq-audit (>=0.0.1, <=0.0.3) +14 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.1.release, =4.0.0, =0.1.0, =4.26.0, =4.26.0, =3.3.0.6, =4.30.0 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

br.com.anteros:anteros-keycloak (1.0.0), com.blossom-project:blossom-starter-ui-api (>=1.0.0.m2, <=1.1.1) +47 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =1.0.6, =1.0.0, =0.7.4, =0.7.8 - com.vmware.card-connectors:airwatch-connector 2.1 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

com.ohadr.oauth2:auth-common (>=1.1.3, <=1.6.0-release), de.juplo:facebook-utils (1.0) +12 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.5.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.1.3, =1.0.1, =1.0.1, =1.0.1, =2.0.0, =1.3.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 - org.ozwillo.datacore:ozwillo-datacore-core 1.10.1 Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

com.ohadr.oauth2:auth-common (>=1.1.3, <=1.6.0-release), de.juplo:facebook-utils (1.0) +12 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.5.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.1.3, =1.0.1, =1.0.1, =1.0.1, =2.0.0, =1.3.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 - org.ozwillo.datacore:ozwillo-datacore-core 1.10.1 Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +639 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Q...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +639 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.14.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2018-1260 Source advisory: OSV:GHSA-RRPM-PJ7P-7J9Qhttps://vulners.com/o...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Qhttps://vulners.com/githu...

br.com.anteros:anteros-keycloak (1.0.0), com.blossom-project:blossom-starter-ui-api (>=1.0.0.m2, <=1.1.1) +47 more potentially affected by CVE-2018-1260 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =1.0.6, =1.0.0, =0.7.4, =0.7.8 - com.vmware.card-connectors:airwatch-connector 2.1 and more Source cves: CVE-2018-1260 Source advisory: GHSA-RRPM-PJ7P-7J9Q...

Spring Security OAuth vulnerable to remote code execution (RCE)

Spring Security OAuth versions prior to 2.3.3, prior to 2.2.2, prior to 2.1.2, and prior to 2.0.15 contain a remote code execution vulnerability. An attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarde...

GHSA-RRPM-PJ7P-7J9Q Spring Security OAuth vulnerable to remote code execution (RCE)

Spring Security OAuth versions prior to 2.3.3, prior to 2.2.2, prior to 2.1.2, and prior to 2.0.15 contain a remote code execution vulnerability. An attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarde...