Search for packages
| purl | pkg:maven/org.springframework.security/spring-security-core@6.3.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1mut-63gq-cbcc
Aliases: CVE-2024-38810 GHSA-hmqf-wpq9-jq83 |
Spring Security Missing Authorization vulnerability Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective. |
Affected by 1 other vulnerability. |
|
VCID-bxeh-gaxy-6uch
Aliases: CVE-2026-22746 GHSA-vxf7-qj7q-83fh |
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-u6vb-w2bu-ykfk
Aliases: CVE-2024-38827 GHSA-q3v6-hm2v-pw99 |
Spring Framework has Authorization Bypass for Case Sensitive Comparisons The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||