7022 matches found
Design/Logic Flaw
Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall...
CVE-2021-22113
Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall...
CVE-2021-22113
The CVE-2021-22113 entry concerns Spring Cloud Netflix Zuul 2.2.6.RELEASE and earlier, where the Sensitive Headers functionality can be bypassed by specially constructed URLs. The Red Hat and GN documents corroborate that Zuul’s handling of sensitive headers is vulnerable, potentially allowing an...
Vmware Spring Cloud Security Vulnerability
Vmware Spring Cloud Config is a set of configuration management solutions for distributed systems from Vmware. The product focuses on providing server and client support for external configuration in distributed systems. Spring Cloud Netflix Zuul 2.2.6.RELEASE A security vulnerability exists in t...
The vulnerability of the Spring Framework software platform, related to insecure management of privileges, allows attackers to compromise the confidentiality and integrity of protected information.
The vulnerability of the Spring Framework software platform is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...
CVE-2021-22112
A flaw was found in jenkins. Unintentional persisted temporary elevated privileges in some circumstances in a user's session can occur in Spring Security. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
jenkins -- Privilege escalation vulnerability in bundled Spring Security library
Jenkins Security Advisory: Description high SECURITY-2195 / CVE-2021-22112 Privilege escalation vulnerability in bundled Spring Security library...
Vmware VMware Spring Security Permission License and Access Control Issues Vulnerability
Vmware VMware Spring Security is a suite of security frameworks from Vmware that provide illustrative security protections for Spring-based applications. A vulnerability exists in VMware Spring Security with privilege permission and access control issues. The vulnerability stems from an attacker...
The vulnerability of the OAuth component in the Java framework for securing Spring-based industrial applications allows attackers to escalate their privileges and gain unauthorized access to protected information.
The vulnerability of the OAuth component in the Java framework for securing Spring-based industrial applications relates to the redirection of URLs to insecure websites. Exploiting this vulnerability allows an attacker to enhance their privileges and gain unauthorized access to protected...
The vulnerability of web services in the Spring Framework software platform allows attackers to compromise the confidentiality, integrity, and accessibility of information.
The vulnerability of web services in the Spring Framework is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of information...
Authorization Bypass
spring-cloud-netflix-zuul is vulnerable to authorization bypass. An attacker is able to send a request containing a malicious URL to bypass the “Sensitive Headers” restrictions. Applications using Spring Security's StrictHttpFirewall enabled by default for all URLs are not affected by this...
Update Atlassian Platform to 3.5.19 to fix CVE-2018-1000613, CVE-2019-17571 and other vulnerabilities
Update Atlassian Platform from 3.5.17 to 3.5.19. The new platform version brings changes in the following libraries: update com.atlassian.applinks: from 5.4.21 to 5.4.23 update com.atlassian.plugins: from 4.4.10 to 4.4.14 update com.atlassian.sal: from 3.1.2 to 3.1.3 update com.atlassian.streams:...
Update Atlassian Platform to 3.5.19 to fix CVE-2018-1000613, CVE-2019-17571 and other vulnerabilities
Update Atlassian Platform from 3.5.17 to 3.5.19. The new platform version brings changes in the following libraries: update com.atlassian.applinks: from 5.4.21 to 5.4.23 update com.atlassian.plugins: from 4.4.10 to 4.4.14 update com.atlassian.sal: from 3.1.2 to 3.1.3 update com.atlassian.streams:...
CVE-2020-17523
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...
CVE-2020-17523
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...
UBUNTU-CVE-2020-17523
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...
Authentication flaw
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...
CVE-2020-17523
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...
