CVE-2018-1258 in Oracle Communications Network Integrityinfo

Summary

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Reservation

12/06/2017

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
158121	Oracle Communications Network Integrity Core authorization	863	Not defined	Official fix	CVE-2018-1258
153646	Oracle Retail Xstore Point of Service Xenvironment authorization	863	Not defined	Official fix	CVE-2018-1258
148948	Oracle Retail Markdown Optimization Common Component Integration authorization	863	Not defined	Official fix	CVE-2018-1258
148947	Oracle Retail Clearance Optimization Engine Dataset authorization	863	Not defined	Official fix	CVE-2018-1258
138116	Oracle Retail Service Backbone Spring authorization	863	Not defined	Official fix	CVE-2018-1258
138115	Oracle Retail Predictive Application Server Spring authorization	863	Not defined	Official fix	CVE-2018-1258
138114	Oracle Retail Predictive Application Server Spring authorization	863	Not defined	Official fix	CVE-2018-1258
133759	Oracle Utilities Network Management System Web Gateway Client authorization	863	Not defined	Official fix	CVE-2018-1258
133599	Oracle WebLogic Server WLS Core Components authorization	863	Not defined	Official fix	CVE-2018-1258
133572	Oracle FLEXCUBE Private Banking Spring authorization	863	Not defined	Official fix	CVE-2018-1258
133562	Oracle Enterprise Manager Ops Center Networking authorization	863	Not defined	Official fix	CVE-2018-1258
133561	Oracle Enterprise Manager Base Platform Enterprise Manager Install authorization	863	Not defined	Official fix	CVE-2018-1258
133499	Oracle Communications Unified Inventory Management Spring authorization	863	Not defined	Official fix	CVE-2018-1258
129676	Oracle Retail Customer Insights Spring authorization	863	Not defined	Official fix	CVE-2018-1258
129610	Oracle Insurance Rules Palette Spring authorization	863	Not defined	Official fix	CVE-2018-1258
129609	Oracle Insurance Calculation Engine Spring authorization	863	Not defined	Official fix	CVE-2018-1258
129598	Oracle Healthcare Master Person Index Spring authorization	863	Not defined	Official fix	CVE-2018-1258
129597	Oracle Health Sciences Information Manager Health Policy authorization	863	Not defined	Official fix	CVE-2018-1258
129510	Oracle Application Testing Suite OpenSSL authorization	863	Not defined	Official fix	CVE-2018-1258
129468	Oracle Communications Services Gatekeeper Spring authorization	863	Not defined	Official fix	CVE-2018-1258
129467	Oracle Communications Performance Intelligence Center Software Spring authorization	863	Not defined	Official fix	CVE-2018-1258
129466	Oracle Communications Diameter Signaling Router Spring authorization	863	Not defined	Official fix	CVE-2018-1258
125646	Oracle Agile PLM Application Server improper authorization	285	Not defined	Official fix	CVE-2018-1258
125609	Oracle Retail Integration Bus RIB Kernal authorization	863	Not defined	Official fix	CVE-2018-1258
125608	Oracle Retail Financial Integration PeopleSoft Integration Bugs authorization	863	Not defined	Official fix	CVE-2018-1258
125607	Oracle Retail Assortment Planning Application Core authorization	863	Not defined	Official fix	CVE-2018-1258
125606	Oracle MICROS Lucas Spring authorization	863	Not defined	Official fix	CVE-2018-1258
125534	Oracle MySQL Enterprise Monitor Monitoring authorization	863	Not defined	Official fix	CVE-2018-1258
125489	Oracle Hospitality Guest Access Spring authorization	863	Not defined	Official fix	CVE-2018-1258
125436	Oracle WebLogic Server Spring authorization	863	Not defined	Official fix	CVE-2018-1258
125435	Oracle Endeca Information Discovery Integrator Spring authorization	863	Not defined	Official fix	CVE-2018-1258
125415	Oracle Enterprise Manager for MySQL Database EM Plugin authorization	863	Not defined	Official fix	CVE-2018-1258
117636	Spring Framework improper authorization	285	Not defined	Official fix	CVE-2018-1258

Description

CPE

CWE

CVSS

Exploits

History

Diff

Relate

Threat Intelligence

API JSON

API XML

API CSV

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!