Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-vxf7-qj7q-83fh
  • Maven/org.springframework.security:spring-security-core
 Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider 22 Apr
  • Fix available
  • Severity - 3.7 (Low)
GHSA-x2wq-9x2f-fhj7
  • Maven/org.springframework.security:spring-security-core
 Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured 21 Apr
  • Fix available
  • Severity - 4.8 (Medium)
GHSA-vqxh-445g-37fc
  • Maven/org.springframework.security:spring-security-core
 Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide 22 Jan
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-8v5q-rhf3-jphm
  • Maven/org.springframework.security:spring-security-core
 Spring Security annotation detection mechanism has authorization bypass 16 Sep 2025
  • Fix available
  • Severity - 7.5 (High)
GHSA-9pp5-9c7g-4r83
  • Maven/org.springframework.security:spring-security-aspects
  • Maven/org.springframework.security:spring-security-core
 Spring Security authorization bypass for method security annotations on private methods 21 May 2025
  • Fix available
  • Severity - 9.1 (Critical)
GHSA-hh3m-g4qj-4835
  • Maven/org.springframework.security:spring-security-core
 Spring Security Vulnerable to Authorization Bypass via Security Annotations 24 Mar 2025
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-q3v6-hm2v-pw99
  • Maven/org.springframework.security:spring-security-core
 Spring Framework has Authorization Bypass for Case Sensitive Comparisons 02 Dec 2024
  • Fix available
  • Severity - 6.3 (Medium)
GHSA-hmqf-wpq9-jq83
  • Maven/org.springframework.security:spring-security-core
 Spring Security Missing Authorization vulnerability 20 Aug 2024
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-f3jh-qvm4-mg39
  • Maven/org.springframework.security:spring-security-core
 Erroneous authentication pass in Spring Security 18 Mar 2024
  • Fix available
  • Severity - 8.2 (High)
GHSA-w3w6-26f2-p474
  • Maven/org.springframework.security:spring-security-core
 Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated 20 Feb 2024
  • Fix available
  • Severity - 7.4 (High)
GHSA-x873-6rgc-94jc
  • Maven/org.springframework.security:spring-security-core
 Spring Security logout not clearing security context 19 Apr 2023
  • Fix available
  • Severity - 6.3 (Medium)
GHSA-mmmh-wcxm-2wr4
  • Maven/org.springframework.security:spring-security-core
 Spring Security authorization rules can be bypassed via forward or include dispatcher types 01 Nov 2022
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-hh32-7344-cg2f
  • Maven/org.springframework.security:spring-security-core
  • Maven/org.springframework.security:spring-security-web
 Authorization bypass in Spring Security 20 May 2022
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-wx54-3278-m5g4
  • Maven/org.springframework.security:spring-security-core
 Integer overflow in BCrypt class in Spring Security 20 May 2022
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-5xm9-rf63-wj7h
  • Maven/org.springframework.security:spring-security-core
 Improper Control of Generation of Code in Spring Security 17 May 2022
  • Fix available
GHSA-3533-rvpc-6x56
  • Maven/org.springframework.security:spring-security-core
 Exposure of Sensitive Information to an Unauthorized Actor in Spring Security 17 May 2022
  • Fix available
Load more...