br.net.woodstock.rockframework:rockframework-domain (>=1.2.4, <=3.0.1), br.net.woodstock.rockframework:rockframework-persistence (>=2.0.0, <=2.0.8) +23 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.0.6.release)

org.springframework.security:spring-security-core MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - br.net.woodstock.rockframework:rockframework-domain...

com.github.lrkwz:urlmanaged-locale (0.0.1), com.isotrol.impe3.extensions:impe3-pms-ldap (>=3.0.0, <=3.1.1) +69 more potentially affected by CVE-2016-5007 via org.springframework.security:spring-security-core (3.0.7.release)

org.springframework.security:spring-security-core MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.lrkwz:urlmanaged-locale 0.0.1 -...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +20 more potentially affected by CVE-2018-1271 via org.springframework:spring-core (2.0-m2)

org.springframework:spring-core MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0 - org.acegisecurity:acegi-security-adapters...

GHSA-CXRJ-66C5-9FMH Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...

Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...

Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

GHSA-V596-FWHQ-8X48 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +690 more potentially affected by CVE-2018-1199 via org.springframework.security:spring-security-core (>=4.1.0.release, <=4.1.4.release)

org.springframework.security:spring-security-core MAVEN version =4.1.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1, =1.0.0-rc, =1.0.6.oss, =1.0.6.oss, =1.0.7.oss, =1.0.7.oss, =3.0.1.3, =3.0.0, =3.0.1.2, =3.0.1.11 and more Source cves: CVE-2018-1199 Source advisory: GHSA-V596-FWHQ-8X48...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +1433 more potentially affected by CVE-2018-1199 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.3.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =1.3.0, =1.3.0, =1.3.0, =0.0.1, =0.0.1-fenicesfa and more Source cves: CVE-2018-1199 Source advisory: OSV:GHSA-V596-FWHQ-8X48...

ch.rasc:wamp2spring-security (1.0.0), com.github.henkexbg:gallery-api (0.3.0) +58 more potentially affected by CVE-2018-1199 via org.springframework.security:spring-security-core (5.0.0.release)

org.springframework.security:spring-security-core MAVEN version 5.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - ch.rasc:wamp2spring-security 1.0.0 -...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +690 more potentially affected by CVE-2018-1199 via org.springframework.security:spring-security-core (>=4.1.0.release, <=4.1.4.release)

org.springframework.security:spring-security-core MAVEN version =4.1.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1, =1.0.0-rc, =1.0.6.oss, =1.0.6.oss, =1.0.7.oss, =1.0.7.oss, =3.0.1.3, =3.0.0, =3.0.1.2, =3.0.1.11 and more Source cves: CVE-2018-1199 Source advisory: OSV:GHSA-V596-FWHQ-8X48...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +1433 more potentially affected by CVE-2018-1199 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.3.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =1.3.0, =1.3.0, =1.3.0, =0.0.1, =0.0.1-fenicesfa and more Source cves: CVE-2018-1199 Source advisory: GHSA-V596-FWHQ-8X48...

ch.rasc:wamp2spring-security (1.0.0), com.github.henkexbg:gallery-api (0.3.0) +58 more potentially affected by CVE-2018-1199 via org.springframework.security:spring-security-core (5.0.0.release)

org.springframework.security:spring-security-core MAVEN version 5.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - ch.rasc:wamp2spring-security 1.0.0 -...

spring-security-oauth: remote code execution in the authorization process

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lea...

Privilege Escalation in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +9 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (2.0-m2)

org.springframework:spring-webmvc MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0-rc2, =1.0.0 -...

Security Bulletin: Remote code execution vulnerability (CVE-2018-1260) affects IBM Spectrum Symphony 7.2.0.2 and 7.2.1

Summary Interim fixes are needed to upgrade the Spring Security OAuth package in IBM Spectrum Symphony 7.2.0.2 and 7.2.1 to resolve the remote code execution vulnerability CVE-2018-1260. Vulnerability Details CVEID: CVE-2018-1260 DESCRIPTION: Pivotal Spring Security OAuth could allow a remote...

spring-framework: Improper URL path validation allows for bypassing of security checks on static resources

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

Information Leakage

spring-security-oauth2-jose is vulnerable to information leakage. It reveals class information via the exception message when a plain unsigned JWT signature is submitted...

spring-security-oauth: remote code execution in the authorization process

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lea...