java-security
Safeguard articles tagged "java-security" — guides, analysis, and best practices for software supply chain and application security.
139 articles
CVE-2024-22234: The Spring Security Access Control Bypass Explained
CVE-2024-22234 is a broken access control flaw in Spring Security where isFullyAuthenticated returns true for a null authentication. Here is how it works and how to fix it.
Apache Struts 2 Vulnerability History: The RCE Flaws You Must Patch
Apache Struts 2 vulnerabilities have caused some of the largest breaches on record. Here is the CVE lineage, why the same flaw keeps recurring, and how to detect it.
Fixing XXE in Java: A Parser-by-Parser Hardening Guide
A parser-by-parser XXE fix for Java, covering DocumentBuilderFactory, SAXParser, XMLInputFactory, TransformerFactory, and the XML libraries that still ship unsafe defaults.
Uncaught Exception in Java: A Security Guide
An uncaught exception in Java is more than a crash - it leaks stack traces, kills threads, and opens denial-of-service paths. Here is how to handle it safely.
Java Vulnerability Classes: A Reference List
A java vulnerability list organized by class — deserialization, injection, XXE, and the rest — because Java's ecosystem produces a specific, recurring set of vulnerability patterns worth knowing by name.
Java Deserialization Vulnerabilities: How They Work and How to Stop Them
A practical explanation of the Java deserialization vulnerability class: why untrusted object deserialization leads to remote code execution, and how to defend against it.
Log4j Maven Dependency: How to Find, Fix, and Pin It Safely
A practical guide to the Log4j Maven dependency: how to detect log4j-core in your tree, why 2.17.1 is the version to target, and how to pin it for good.
CVE-2020-15250: The JUnit Temp File Vulnerability
CVE-2020-15250 shows how a test-only utility class in JUnit 4 created world-readable temp files on Unix systems, and why it still shows up in scans of projects that never touched production code paths.
CVE-2021-29425: The Commons IO Path Traversal Bug
CVE-2021-29425 shows how a single unhandled case in Apache Commons IO's path normalization let attackers slip past directory checks that assumed a canonicalized path was actually safe.
Insecure deserialization attack
A precise breakdown of what is an insecure deserialization attack, how object injection and gadget chains work in Java and Python, and how to defend against them.
Securing Spring Security OAuth2 and JOSE Dependencies
spring-security-oauth2-jose sits at the center of many Java auth stacks, but the legacy project is deprecated and its JOSE/JWT dependencies carry their own patch history; here is how to assess and reduce the risk.
Java Security Explained
Java security failures like Log4Shell exposed 3 billion devices — here's why Java's dependency depth makes it uniquely risky, and how to fix it fast.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.