Search for packages
| purl | pkg:maven/org.springframework.security/spring-security-core@4.2.7.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2020-5408
|
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-3795
|
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-11272
|
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-hh32-7344-cg2f
Aliases: CVE-2022-22978 |
Authorization bypass in Spring Security In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be … |
Vulnerable |
|
GHSA-v2r2-7qm7-jj6v
Aliases: CVE-2019-3795 |
Spring Security uses insufficiently random values Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior … | There are no reported fixed by versions. |
|
GHSA-v33x-prhc-gph5
Aliases: CVE-2019-11272 |
Insufficiently Protected Credentials and Improper Authentication in Spring Security Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions … | There are no reported fixed by versions. |
|
GHSA-q3v6-hm2v-pw99
Aliases: CVE-2024-38827 |
Spring Framework has Authorization Bypass for Case Sensitive Comparisons The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions … |
Vulnerable |
|
GHSA-f3jh-qvm4-mg39
Aliases: CVE-2024-22257 |
Erroneous authentication pass in Spring Security In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x … |
Vulnerable |
|
GHSA-2ppp-9496-p23q
Aliases: CVE-2020-5408 |
Insufficient Entropy in Spring Security Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, … | There are no reported fixed by versions. |
|
CVE-2019-11272
|
PlaintextPasswordEncoder authenticates encoded passwords that are null Spring Security supports plain text passwords using `PlaintextPasswordEncoder`. a malicious user (or attacker) … |
Vulnerable |
|
CVE-2022-22976
Aliases: GHSA-wx54-3278-m5g4 |
Integer overflow in BCrypt class in Spring Security Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and … |
Vulnerable Vulnerable |
|
CVE-2021-22112
|
Privilege Escalation Spring Security can fail to save the `SecurityContext` if it is changed more than once in a single … |
Vulnerable |
|
CVE-2020-5408
|
Use of Insufficiently Random Values Spring Security uses a fixed null initialization vector with CBC Mode in the implementation of … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-3795
|
Insufficient Entropy in PRNG Spring Security contain an insecure randomness vulnerability when using `SecureRandomFactoryBean#setSeed` to configure a `SecureRandom` instance. In … |
Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2017-4995
|
An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default … |