Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-deuk-emca-3kgr
SummaryAn issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.
Aliases
0
alias CVE-2016-9879
1
alias GHSA-v35c-49j6-q8hq
Fixed_packages
0
url pkg:maven/org.springframework.security/spring-security-core@3.2.10.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.10.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-dfs4-emmn-f3eb
2
vulnerability VCID-dwcq-d6nf-1ubn
3
vulnerability VCID-u6vb-w2bu-ykfk
4
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.10.RELEASE
1
url pkg:maven/org.springframework.security/spring-security-core@4.1.4.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.1.4.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-dwcq-d6nf-1ubn
2
vulnerability VCID-hedq-eav6-4fee
3
vulnerability VCID-qpxj-fzta-v7bs
4
vulnerability VCID-u6vb-w2bu-ykfk
5
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.1.4.RELEASE
2
url pkg:maven/org.springframework.security/spring-security-core@4.2.1.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.2.1.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-dwcq-d6nf-1ubn
2
vulnerability VCID-f3g5-hamr-6yar
3
vulnerability VCID-hedq-eav6-4fee
4
vulnerability VCID-pz7c-p4ze-kfhc
5
vulnerability VCID-qpxj-fzta-v7bs
6
vulnerability VCID-u6vb-w2bu-ykfk
7
vulnerability VCID-xdnd-ar9s-afd8
8
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.2.1.RELEASE
Affected_packages
0
url pkg:maven/org.springframework.security/spring-security-core@3.0.0.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.0.0.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-ev1k-za9z-87hq
6
vulnerability VCID-n8yr-3aex-kyah
7
vulnerability VCID-nddv-1dfd-jfdd
8
vulnerability VCID-sy5j-6rkg-n3b7
9
vulnerability VCID-u6vb-w2bu-ykfk
10
vulnerability VCID-w4q4-38gp-m3d8
11
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.0.RELEASE
1
url pkg:maven/org.springframework.security/spring-security-core@3.0.1.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.0.1.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-ev1k-za9z-87hq
6
vulnerability VCID-n8yr-3aex-kyah
7
vulnerability VCID-nddv-1dfd-jfdd
8
vulnerability VCID-sy5j-6rkg-n3b7
9
vulnerability VCID-u6vb-w2bu-ykfk
10
vulnerability VCID-w4q4-38gp-m3d8
11
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.1.RELEASE
2
url pkg:maven/org.springframework.security/spring-security-core@3.0.2.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.0.2.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-ev1k-za9z-87hq
6
vulnerability VCID-n8yr-3aex-kyah
7
vulnerability VCID-nddv-1dfd-jfdd
8
vulnerability VCID-sy5j-6rkg-n3b7
9
vulnerability VCID-u6vb-w2bu-ykfk
10
vulnerability VCID-w4q4-38gp-m3d8
11
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.2.RELEASE
3
url pkg:maven/org.springframework.security/spring-security-core@3.0.3.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.0.3.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-ev1k-za9z-87hq
6
vulnerability VCID-n8yr-3aex-kyah
7
vulnerability VCID-nddv-1dfd-jfdd
8
vulnerability VCID-sy5j-6rkg-n3b7
9
vulnerability VCID-u6vb-w2bu-ykfk
10
vulnerability VCID-w4q4-38gp-m3d8
11
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.3.RELEASE
4
url pkg:maven/org.springframework.security/spring-security-core@3.0.4.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.0.4.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-ev1k-za9z-87hq
6
vulnerability VCID-nddv-1dfd-jfdd
7
vulnerability VCID-sy5j-6rkg-n3b7
8
vulnerability VCID-u6vb-w2bu-ykfk
9
vulnerability VCID-w4q4-38gp-m3d8
10
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.4.RELEASE
5
url pkg:maven/org.springframework.security/spring-security-core@3.0.5.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.0.5.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-ev1k-za9z-87hq
6
vulnerability VCID-nddv-1dfd-jfdd
7
vulnerability VCID-sy5j-6rkg-n3b7
8
vulnerability VCID-u6vb-w2bu-ykfk
9
vulnerability VCID-w4q4-38gp-m3d8
10
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.5.RELEASE
6
url pkg:maven/org.springframework.security/spring-security-core@3.0.6.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.0.6.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-w4q4-38gp-m3d8
7
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.6.RELEASE
7
url pkg:maven/org.springframework.security/spring-security-core@3.0.7.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.0.7.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-w4q4-38gp-m3d8
7
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.7.RELEASE
8
url pkg:maven/org.springframework.security/spring-security-core@3.0.8.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.0.8.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.0.8.RELEASE
9
url pkg:maven/org.springframework.security/spring-security-core@3.1.0.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.1.0.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-w4q4-38gp-m3d8
7
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.1.0.RELEASE
10
url pkg:maven/org.springframework.security/spring-security-core@3.1.1.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.1.1.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-w4q4-38gp-m3d8
7
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.1.1.RELEASE
11
url pkg:maven/org.springframework.security/spring-security-core@3.1.2.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.1.2.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-w4q4-38gp-m3d8
7
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.1.2.RELEASE
12
url pkg:maven/org.springframework.security/spring-security-core@3.1.3.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.1.3.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.1.3.RELEASE
13
url pkg:maven/org.springframework.security/spring-security-core@3.1.4.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.1.4.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-kqpg-9cqw-nuen
6
vulnerability VCID-u6vb-w2bu-ykfk
7
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.1.4.RELEASE
14
url pkg:maven/org.springframework.security/spring-security-core@3.1.5.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.1.5.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.1.5.RELEASE
15
url pkg:maven/org.springframework.security/spring-security-core@3.1.6.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.1.6.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.1.6.RELEASE
16
url pkg:maven/org.springframework.security/spring-security-core@3.1.7.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.1.7.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dfs4-emmn-f3eb
3
vulnerability VCID-dwcq-d6nf-1ubn
4
vulnerability VCID-u6vb-w2bu-ykfk
5
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.1.7.RELEASE
17
url pkg:maven/org.springframework.security/spring-security-core@3.2.0.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.0.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.0.RELEASE
18
url pkg:maven/org.springframework.security/spring-security-core@3.2.1.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.1.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-kqpg-9cqw-nuen
6
vulnerability VCID-u6vb-w2bu-ykfk
7
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.1.RELEASE
19
url pkg:maven/org.springframework.security/spring-security-core@3.2.2.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.2.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.2.RELEASE
20
url pkg:maven/org.springframework.security/spring-security-core@3.2.3.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.3.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.3.RELEASE
21
url pkg:maven/org.springframework.security/spring-security-core@3.2.4.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.4.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8jtc-ehgu-x3c5
1
vulnerability VCID-cden-3spy-pyhz
2
vulnerability VCID-deuk-emca-3kgr
3
vulnerability VCID-dfs4-emmn-f3eb
4
vulnerability VCID-dwcq-d6nf-1ubn
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.4.RELEASE
22
url pkg:maven/org.springframework.security/spring-security-core@3.2.5.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.5.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dfs4-emmn-f3eb
3
vulnerability VCID-dwcq-d6nf-1ubn
4
vulnerability VCID-u6vb-w2bu-ykfk
5
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.5.RELEASE
23
url pkg:maven/org.springframework.security/spring-security-core@3.2.6.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.6.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dfs4-emmn-f3eb
3
vulnerability VCID-dwcq-d6nf-1ubn
4
vulnerability VCID-u6vb-w2bu-ykfk
5
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.6.RELEASE
24
url pkg:maven/org.springframework.security/spring-security-core@3.2.7.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.7.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dfs4-emmn-f3eb
3
vulnerability VCID-dwcq-d6nf-1ubn
4
vulnerability VCID-u6vb-w2bu-ykfk
5
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.7.RELEASE
25
url pkg:maven/org.springframework.security/spring-security-core@3.2.8.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.8.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dfs4-emmn-f3eb
3
vulnerability VCID-dwcq-d6nf-1ubn
4
vulnerability VCID-u6vb-w2bu-ykfk
5
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.8.RELEASE
26
url pkg:maven/org.springframework.security/spring-security-core@3.2.9.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@3.2.9.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dfs4-emmn-f3eb
3
vulnerability VCID-dwcq-d6nf-1ubn
4
vulnerability VCID-u6vb-w2bu-ykfk
5
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@3.2.9.RELEASE
27
url pkg:maven/org.springframework.security/spring-security-core@4.0.0.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.0.0.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dfs4-emmn-f3eb
3
vulnerability VCID-dwcq-d6nf-1ubn
4
vulnerability VCID-u6vb-w2bu-ykfk
5
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.0.0.RELEASE
28
url pkg:maven/org.springframework.security/spring-security-core@4.1-alpha0
purl pkg:maven/org.springframework.security/spring-security-core@4.1-alpha0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-deuk-emca-3kgr
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.1-alpha0
29
url pkg:maven/org.springframework.security/spring-security-core@4.1.0.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.1.0.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dfs4-emmn-f3eb
3
vulnerability VCID-dwcq-d6nf-1ubn
4
vulnerability VCID-hedq-eav6-4fee
5
vulnerability VCID-qpxj-fzta-v7bs
6
vulnerability VCID-u6vb-w2bu-ykfk
7
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.1.0.RELEASE
30
url pkg:maven/org.springframework.security/spring-security-core@4.1.1.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.1.1.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dwcq-d6nf-1ubn
3
vulnerability VCID-hedq-eav6-4fee
4
vulnerability VCID-qpxj-fzta-v7bs
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.1.1.RELEASE
31
url pkg:maven/org.springframework.security/spring-security-core@4.1.2.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.1.2.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dwcq-d6nf-1ubn
3
vulnerability VCID-hedq-eav6-4fee
4
vulnerability VCID-qpxj-fzta-v7bs
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.1.2.RELEASE
32
url pkg:maven/org.springframework.security/spring-security-core@4.1.3.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.1.3.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dwcq-d6nf-1ubn
3
vulnerability VCID-hedq-eav6-4fee
4
vulnerability VCID-qpxj-fzta-v7bs
5
vulnerability VCID-u6vb-w2bu-ykfk
6
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.1.3.RELEASE
33
url pkg:maven/org.springframework.security/spring-security-core@4.2-alpha0
purl pkg:maven/org.springframework.security/spring-security-core@4.2-alpha0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-deuk-emca-3kgr
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.2-alpha0
34
url pkg:maven/org.springframework.security/spring-security-core@4.2.0.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.2.0.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-deuk-emca-3kgr
2
vulnerability VCID-dwcq-d6nf-1ubn
3
vulnerability VCID-f3g5-hamr-6yar
4
vulnerability VCID-hedq-eav6-4fee
5
vulnerability VCID-pz7c-p4ze-kfhc
6
vulnerability VCID-qpxj-fzta-v7bs
7
vulnerability VCID-u6vb-w2bu-ykfk
8
vulnerability VCID-xdnd-ar9s-afd8
9
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.2.0.RELEASE
References
0
reference_url https://access.redhat.com/errata/RHSA-2017:1832
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2017:1832
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9879.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9879.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-9879
reference_id
reference_type
scores
0
value 0.00322
scoring_system epss
scoring_elements 0.5531
published_at 2026-04-21T12:55:00Z
1
value 0.00322
scoring_system epss
scoring_elements 0.55267
published_at 2026-04-07T12:55:00Z
2
value 0.00322
scoring_system epss
scoring_elements 0.55318
published_at 2026-04-09T12:55:00Z
3
value 0.00322
scoring_system epss
scoring_elements 0.55329
published_at 2026-04-11T12:55:00Z
4
value 0.00322
scoring_system epss
scoring_elements 0.55308
published_at 2026-04-12T12:55:00Z
5
value 0.00322
scoring_system epss
scoring_elements 0.55289
published_at 2026-04-13T12:55:00Z
6
value 0.00322
scoring_system epss
scoring_elements 0.55327
published_at 2026-04-16T12:55:00Z
7
value 0.00322
scoring_system epss
scoring_elements 0.55331
published_at 2026-04-18T12:55:00Z
8
value 0.00322
scoring_system epss
scoring_elements 0.55162
published_at 2026-04-01T12:55:00Z
9
value 0.00322
scoring_system epss
scoring_elements 0.55263
published_at 2026-04-02T12:55:00Z
10
value 0.00322
scoring_system epss
scoring_elements 0.55286
published_at 2026-04-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-9879
3
reference_url https://github.com/spring-projects/spring-security/commit/666e356ebc479194ba51e43bb99fc42f849b6175
reference_id
reference_type
scores
url https://github.com/spring-projects/spring-security/commit/666e356ebc479194ba51e43bb99fc42f849b6175
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-9879
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-9879
5
reference_url http://www.securityfocus.com/bid/95142
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/95142
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1409838
reference_id 1409838
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1409838
7
reference_url https://pivotal.io/security/cve-2016-9879
reference_id CVE-2016-9879
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://pivotal.io/security/cve-2016-9879
8
reference_url https://github.com/advisories/GHSA-v35c-49j6-q8hq
reference_id GHSA-v35c-49j6-q8hq
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-v35c-49j6-q8hq
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 417
name Communication Channel Errors
description Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
3
cwe_id 20
name Improper Input Validation
description The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Exploits
Severity_range_score6.5 - 8.9
Exploitability0.5
Weighted_severity8.0
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-deuk-emca-3kgr