Search for packages
| purl | pkg:maven/org.springframework.security/spring-security-core@4.1.2.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2020-5408
|
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-3795
|
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-11272
|
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-hh32-7344-cg2f
Aliases: CVE-2022-22978 |
Authorization bypass in Spring Security In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be … |
Vulnerable |
|
GHSA-v33x-prhc-gph5
Aliases: CVE-2019-11272 |
Insufficiently Protected Credentials and Improper Authentication in Spring Security Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions … | There are no reported fixed by versions. |
|
GHSA-q3v6-hm2v-pw99
Aliases: CVE-2024-38827 |
Spring Framework has Authorization Bypass for Case Sensitive Comparisons The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions … |
Vulnerable |
|
GHSA-f3jh-qvm4-mg39
Aliases: CVE-2024-22257 |
Erroneous authentication pass in Spring Security In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x … |
Vulnerable |
|
GHSA-2ppp-9496-p23q
Aliases: CVE-2020-5408 |
Insufficient Entropy in Spring Security Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, … | There are no reported fixed by versions. |
|
CVE-2016-9879
|
Encoded "/" in path variables This package does not consider URL path parameters when processing security constraints.Users of IBM WebSphere … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2022-22976
Aliases: GHSA-wx54-3278-m5g4 |
Integer overflow in BCrypt class in Spring Security Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and … |
Vulnerable Vulnerable |
|
CVE-2021-22112
|
Privilege Escalation Spring Security can fail to save the `SecurityContext` if it is changed more than once in a single … |
Vulnerable |
|
CVE-2020-5408
|
Use of Insufficiently Random Values Spring Security uses a fixed null initialization vector with CBC Mode in the implementation of … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-v596-fwhq-8x48
Aliases: CVE-2018-1199 |
Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and … | There are no reported fixed by versions. |
|
GHSA-v35c-49j6-q8hq
Aliases: CVE-2016-9879 |
Security Constraint Bypass in Spring Security Spring Security does not consider URL path parameters when processing security constraints. By adding … |
Vulnerable Vulnerable |
|
CVE-2018-1199
|
Improper Input Validation Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2017-4995
|
An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default … |