Advisories · Technology
Spring Security.
Every CVE that names Spring Security among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 3.7 Low
Spring Security InetAddressMatchers Incomplete Internal Network Classification
- Spring Security
- CWE-693
- CVSS 5.9 Medium
Timing Attack via Non-Constant-Time Comparison of Sensitive Values
- Spring Security
- CWE-208
- CVSS 9.4 CriticalCritical · CVSS 9+
Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
- Spring Security
- CVSS 8.2 High
Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
- Spring Security
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation
- Spring Security
- CVSS 7.4 High
WebAuthn User Verification Bypass via Session Serialization
- Spring Security
- CVSS 7.4 High
Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
- Spring Security
- Authentication bypass