Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:02:18 +0000 EUVD-2026-175557 https://cve.radiocsirt.org/vuln/euvd-2026-175557 EUVD-2026-175557 https://cve.radiocsirt.org/vuln/euvd-2026-175557 fkie_cve-2012-5055 https://cve.radiocsirt.org/vuln/fkie_cve-2012-5055 <p>DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.</p> <p>DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2012-5055 GHSA-3533-rvpc-6x56 — Exposure of Sensitive Information to an Unauthorized Actor in Spring Security https://cve.radiocsirt.org/vuln/ghsa-3533-rvpc-6x56 <p><strong>Affected:</strong> Maven: org.springframework.security:spring-security-core</p> <p>DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.</p> <p><strong>Affected:</strong> Maven: org.springframework.security:spring-security-core</p> <p>DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.</p> https://cve.radiocsirt.org/vuln/ghsa-3533-rvpc-6x56 gsd-2012-5055 https://cve.radiocsirt.org/vuln/gsd-2012-5055 gsd-2012-5055 https://cve.radiocsirt.org/vuln/gsd-2012-5055 RHSA-2013:0649 — Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update https://cve.radiocsirt.org/vuln/rhsa-2013:0649 <p>Security: Ability to determine if username is valid via DaoAuthenticationProvider apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate</p> <p>Security: Ability to determine if username is valid via DaoAuthenticationProvider apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate</p> https://cve.radiocsirt.org/vuln/rhsa-2013:0649