CVE-2022-22969

CVE-2022-22969 affects Spring Security OAuth (spring-security-oauth2) 2.5.x before 2.5.2 and older unsupported releases. The DoS arises when an attacker initiates multiple OAuth 2.0 Authorization Code Grant authorization requests in a client application, exhausting resources per session. Affected...

CVE-2016-4977

CVE-2016-4977 affects Spring Security OAuth versions 2.0.0–2.0.9 and 1.0.0–1.0.5. The root cause is that, during authorization requests using the whitelabel views, the response_type parameter is evaluated as Spring SpEL, enabling remote code execution. This can lead to remote command execution on...