org.springframework.security:spring-security-web vulnerabilities (TuxCare)
26 vulnerabilities.
-
org.springframework.security:spring-security-webTuxCare Timing Attack via Non-Constant-Time Comparison of Sensitive Values 5.9 Medium -
org.springframework.security:spring-security-webTuxCare Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces 9.4 Critical -
org.springframework.security:spring-security-webTuxCare Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation 6.5 Medium -
org.springframework.security:spring-security-webTuxCare WebAuthn User Verification Bypass via Session Serialization 7.4 High -
org.springframework.security:spring-security-webTuxCare Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay 7.4 High -
org.springframework.security:spring-security-webTuxCare Unauthorized User Impersonation when Using X.509 Client Certificates 6.8 Medium -
org.springframework.security:spring-security-webTuxCare Open Redirect When Using CookieRequestCache 6.1 Medium -
org.springframework.security:spring-security-webTuxCare SAML Payloads Decrypted Without Valid Signature 3.7 Low -
org.springframework.security:spring-security-webTuxCare Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting 7.6 High -
org.springframework.security:spring-security-webTuxCare Unbounded DEFLATE Inflation in SAML 2.0 Service Provider 7.5 High -
org.springframework.security:spring-security-webTuxCare Potential Security Misconfiguration when Using withIssuerLocation 5.3 Medium -
org.springframework.security:spring-security-webTuxCare Unauthorized User Impersonation when Using X.509 Client Certificates 6.8 Medium -
org.springframework.security:spring-security-webTuxCare User Attribute Enumeration when Using DaoAuthenticationProvider 3.7 Low -
org.springframework.security:spring-security-webTuxCare Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions 4.8 Medium -
org.springframework.security:spring-security-webTuxCare Under Some Conditions Spring Security HTTP Headers Are not Written 9.1 Critical -
org.springframework.security:spring-security-webTuxCare Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation 5.3 Medium -
org.springframework.security:spring-security-webTuxCare CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types 7.5 High -
org.springframework.security:spring-security-webTuxCare Spring Security Vulnerable to Authorization Bypass via Security Annotations 5.3 Medium -
org.springframework.security:spring-security-webTuxCare CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length 7.4 High -
org.springframework.security:spring-security-webTuxCare Spring Security Authorization Bypass for Case Sensitive Comparisons 4.8 Medium -
org.springframework.security:spring-security-webTuxCare Authorization Bypass of Static Resources in WebFlux Applications 9.1 Critical -
org.springframework.security:spring-security-webTuxCare Erroneous authentication pass in Spring Security 8.2 High -
org.springframework.security:spring-security-webTuxCare CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated 7.4 High -
org.springframework.security:spring-security-webTuxCare Authorization bypass in Spring Security 9.8 Critical -
org.springframework.security:spring-security-webTuxCare Privilege escalation in spring security 8.8 High -
org.springframework.security:spring-security-webTuxCare PlaintextPasswordEncoder authenticates encoded passwords that are null 7.3 High