WaratekVRT Sign in

Springsource Spring Security CVEs

4 CVEs

Reset
More filters (1)
Columns
Product springsource spring security✕
Overview 4 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
4matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC25.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 25.0% No exploit published 3 75.0%
Critical 0 0.0% High 0 0.0% Medium 4 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 25.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 3 / quarter
No exploit published: 3Mitigation candidate: 1 Medium: 4 not blocked: 4 No public exploit: 3Working exploit published: 1
Q4 101 No exploit published1 Medium1 not blocked1 No public exploit1 Q1 110 Q2 110 Q3 110 Q4 110 Q1 120 Q2 120 Q3 120 Q4 123 Mitigation candidate1 No exploit published2 Medium3 not blocked3 Working exploit published1 No public exploit2
Q4 10Q1 11Q2 11Q3 11Q4 11Q1 12Q2 12Q3 12Q4 12
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2012-5055 Medium 2012-12-05 No exploit published No public exploit DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
CVE-2011-2732 Medium 2012-12-05 Mitigation candidate Working exploit published CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
CVE-2011-2731 Medium 2012-12-05 No exploit published No public exploit Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
CVE-2010-3700 Medium 2010-10-29 No exploit published No public exploit VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.