Filtered by vendor Pivotal Subscriptions
Filtered by product Spring Security Oauth Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-4977 1 Pivotal 1 Spring Security Oauth 2023-11-07 N/A
When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.
CVE-2022-22969 2 Oracle, Pivotal 2 Communications Design Studio, Spring Security Oauth 2023-08-08 6.5 Medium
<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.