Most recent entries from all

bdu:2024-02143

certfr-2024-avi-0232 — Une vulnérabilité a été découverte dans les produits Spring Security. Elle permet à un atta…

certfr-2024-avi-0232

Withdrawn: CLEANSTART-2026-GZ54612 — In Spring Security, versions 5

Withdrawn by the publisher.

Affected: CleanStart: apache-nifi

Multiple security vulnerabilities affect the apache-nifi package. In Spring Security, versions 5. See references for individual vulnerability details.

EUVD-2026-331355

fkie_cve-2024-22257

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

GHSA-f3jh-qvm4-mg39 — Erroneous authentication pass in Spring Security

Affected: Maven: org.springframework.security:spring-security-core

Specifically, an application is vulnerable if:

The application uses AuthenticatedVoter directly and a null authentication parameter is passed to it resulting in an erroneous true return value.

An application is not vulnerable if any of the following is true:

* The application does not use AuthenticatedVoter#vote directly. * The application does not pass null to AuthenticatedVoter#vote.

Note that AuthenticatedVoter is deprecated since 5.8, use implementations of AuthorizationManager as a replacement.

gsd-2024-22257

RHSA-2024:3354 — Red Hat Security Advisory: Red Hat Fuse 7.13.0 release and security update

ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE undertow: OutOfMemoryError due to @MultipartConfig handling JSON-java: parser confusion leads to OOM logback: serialization vulnerability in logback receiver logback: A serialization vulnerability in logback receiver spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service jetty: hpack header values cause denial of service in http/2 jetty: Improper addition of quotation marks to user inputs in CgiServlet apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK jetty: Improper validation of HTTP/1 content-length tomcat: HTTP request smuggling via malformed trailer headers shiro: path traversal attack may lead to authentication bypass Solr: Host environment variables are published via the Metrics API undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol tomcat: Leaking of unrelated request bodies in default error page springframework: URL Parsing with Host Validation spring-security: Broken Access Control With Direct Use of AuthenticatedVoter cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding

WID-SEC-W-2024-0658 — VMware Tanzu Spring Security: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Security ausnutzen, um Sicherheitsvorkehrungen zu umgehen.