Daniel Neagaru

**Nome do software vulnerável e versões afetadas** Versões do Tiny Tiny RSS (tt-rss) anteriores a 16/09/2020 **Descrição** O problema está relacionado à falha do Tiny Tiny RSS em validar todos os URLs antes de solicitá-los. Isso poderia potencialmente levar a acesso não autorizado ou outros problemas de segurança. **Recomendações** Para versões anteriores a 16/09/2020, atualize para uma versão lançada após 16/09/2020 para resolver o problema. Como solução temporária, considere restringir o acesso a URLs não validados até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** Spring Security versions 4.2.x up to 4.2.12 **Description** The issue is related to the implementation of the PlaintextPasswordEncoder class in the Spring Security Java framework, which is used to secure industrial applications. It is associated with weaknesses in managing registration data. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information using a null password. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user can authenticate using a password of "null". **Recommendations** For Spring Security versions 4.2.x up to 4.2.12, consider disabling the use of PlaintextPasswordEncoder until a patch is available to prevent malicious users from authenticating with a null password. Restrict access to applications that leverage PlaintextPasswordEncoder to minimize the risk of exploitation. Avoid using null encoded passwords in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.