Search for packages
| purl | pkg:maven/org.springframework.security/spring-security-core@3.2.3.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2020-5408
|
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-3795
|
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-11272
|
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-hh32-7344-cg2f
Aliases: CVE-2022-22978 |
Authorization bypass in Spring Security In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be … |
Vulnerable |
|
GHSA-v33x-prhc-gph5
Aliases: CVE-2019-11272 |
Insufficiently Protected Credentials and Improper Authentication in Spring Security Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions … | There are no reported fixed by versions. |
|
GHSA-q3v6-hm2v-pw99
Aliases: CVE-2024-38827 |
Spring Framework has Authorization Bypass for Case Sensitive Comparisons The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions … |
Vulnerable |
|
GHSA-f3jh-qvm4-mg39
Aliases: CVE-2024-22257 |
Erroneous authentication pass in Spring Security In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x … |
Vulnerable |
|
GHSA-2ppp-9496-p23q
Aliases: CVE-2020-5408 |
Insufficient Entropy in Spring Security Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, … | There are no reported fixed by versions. |
|
CVE-2016-9879
|
Encoded "/" in path variables This package does not consider URL path parameters when processing security constraints.Users of IBM WebSphere … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2022-22976
Aliases: GHSA-wx54-3278-m5g4 |
Integer overflow in BCrypt class in Spring Security Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and … |
Vulnerable Vulnerable |
|
CVE-2021-22112
|
Privilege Escalation Spring Security can fail to save the `SecurityContext` if it is changed more than once in a single … |
Vulnerable |
|
GHSA-8crv-49fr-2h6j
Aliases: CVE-2016-5007 |
Spring Security and Spring Framework may not recognize certain paths that should be protected Both Spring Security 3.2.x, 4.0.x, 4.1.0 … | There are no reported fixed by versions. |
|
GHSA-wmv4-5w76-vp9g
Aliases: CVE-2014-3527 |
Authorization Bypass in Spring Security When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another … | There are no reported fixed by versions. |
|
GHSA-v35c-49j6-q8hq
Aliases: CVE-2016-9879 |
Security Constraint Bypass in Spring Security Spring Security does not consider URL path parameters when processing security constraints. By adding … |
Vulnerable Vulnerable |
|
CVE-2016-5007
|
Improper Access Control Spring Security relies on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2017-4995
|
An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default … |