Skip to content
OpenAdvisories

Archive

5 December 2012

Vulnerabilities first published on this day (UTC), newest first.

← November 2012 2012 / December /5 January 2013 →
  1. 1 
  2. 2 
  3. 338
  4. 46
  5. 524
  6. 67
  7. 7 
  8. 85
  9. 9 
  10. 102
  11. 114
  12. 1226
  13. 1315
  14. 14 
  15. 15 
  16. 16 
  17. 17 
  18. 1818
  19. 1918
  20. 2010
  21. 2120
  22. 22 
  23. 233
  24. 245
  25. 254
  26. 2624
  27. 275
  28. 2810
  29. 29 
  30. 301
  31. 3110
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium —
    CVE-2011-2732 Public exploit

    Improper Control of Generation of Code in Spring Security

    CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-re…

    org.springframework.security:spring-security-core Maven
  • Medium —
    CVE-2011-2731

    Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

    Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

    org.springframework.security:spring-security-core Maven
  • Medium —
    CVE-2012-5055

    Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

    DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerat…

    org.springframework.security:spring-security-core Maven