Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Affected: Maven: org.springframework:spring-core

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

hazelcast: java deserialization in join cluster procedure leading to remote code execution spring-security-core: Unauthorized Access with Spring Security Method Security thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution jolokia: system-wide CSRF that could lead to Remote Code Execution spring-security-oauth: Privilege escalation by manipulating saved authorization request solr: remote code execution due to unsafe deserialization wildfly: Race condition on PID file allows for termination of arbitrary processes by local users

Ein Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.