VMware springsource spring security vulnerabilities

Latest VMware springsource spring security CVEs

Newest publication first

1. CVE-2012-5055 Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

   Published 2012-12-05

   Medium·CVSS 5.0 EPSS 2.0%

   DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via...

2. CVE-2011-2731 Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

   Published 2012-12-05

   Medium·CVSS 5.1 EPSS 1.3%

   Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

3. CVE-2011-2732 Improper Control of Generation of Code in Spring Security

   Published 2012-12-05

   Medium·CVSS 4.3 EPSS 4.6%

   CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

4. CVE-2010-3700 Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

   Published 2010-10-29

   Medium·CVSS 5.0 EPSS 1.7%

   VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.