https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:54:20 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-03033 bdu:2024-03033 https://cve.radiocsirt.org/vuln/bdu:2024-03033 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0398 certfr-2023-avi-0398 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0398 https://cve.radiocsirt.org/vuln/euvd-2026-213644 EUVD-2026-213644 https://cve.radiocsirt.org/vuln/euvd-2026-213644 https://cve.radiocsirt.org/vuln/fkie_cve-2023-20862 <p>In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.</p> <p>In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-20862 https://cve.radiocsirt.org/vuln/ghsa-x873-6rgc-94jc <p><strong>Affected:</strong> Maven: org.springframework.security:spring-security-core</p> <p>In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.</p> <p><strong>Affected:</strong> Maven: org.springframework.security:spring-security-core</p> <p>In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.</p> https://cve.radiocsirt.org/vuln/ghsa-x873-6rgc-94jc https://cve.radiocsirt.org/vuln/gsd-2023-20862 gsd-2023-20862 https://cve.radiocsirt.org/vuln/gsd-2023-20862 https://cve.radiocsirt.org/vuln/rhsa-2024:0778 <p>google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization maven: Block repositories using http by default golang: go/parser: stack exhaustion in all Parse* functions snakeyaml: Denial of Service due to missing nested depth limitation for collections maven-shared-utils: Command injection via Commandline class apache-commons-text: variable interpolation RCE guava: insecure temporary directory creation springframework: Spring Expression DoS Vulnerability spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents Jenkins: Open redirect vulnerability in OpenShift Login Plugin jetty: Improper validation of HTTP/1 content-length jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin jenkins-plugins: config-file-provider: Improper…</p> <p>google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization maven: Block repositories using http by default golang: go/parser: stack exhaustion in all Parse* functions snakeyaml: Denial of Service due to missing nested depth limitation for collections maven-shared-utils: Command injection via Commandline class apache-commons-text: variable interpolation RCE guava: insecure temporary directory creation springframework: Spring Expression DoS Vulnerability spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents Jenkins: Open redirect vulnerability in OpenShift Login Plugin jetty: Improper validation of HTTP/1 content-length jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin jenkins-plugins: config-file-provider: Improper…</p> https://cve.radiocsirt.org/vuln/rhsa-2024:0778 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0994 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in VMware Tanzu Spring Security ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in VMware Tanzu Spring Security ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0994