EUVD-2022-6811

Malicious code in bioql PyPI...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

CVE-2024-24772

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, whi...

CVE-2024-24772: Improper Neutralization of Special Elements used in an SQL Command

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, whi...

org.springframework.data:spring-data-rest-core (2.0.3.release), org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.13.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.13.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-core 2.0.3.release -...

org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.3.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-repository 1.0.0.release ...

io.springfox:springfox-data-rest (>=2.6.0, <=2.6.1), org.apache.geode:geode-web-api (>=1.0.0-incubating, <=1.1.1) potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.21.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.21.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.springfox:springfox-data-rest =2.6.0, =1.0.0-incubating, =1.1.1...

io.springfox:springfox-core (>=2.0.1, <=2.1.2), io.springfox:springfox-petstore (>=2.0.1, <=2.1.2) +9 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.17.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.17.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.springfox:springfox-core =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +3 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.12.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

SUSE CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

SimpleEvaluationContext Class Code Execution

The vulnerability of the SimpleEvaluationContext class in the Spring Data Commons data management platform and the Spring Data REST web framework is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially...

Information Disclosure

spring-data-rest-webmvc is vulnerable to information disclosure. The vulnerability exists due to the improper implementation of the JSON patch in the library, allowing an attacker to get information about the hidden entity attributes through maliciously crafted HTTP requests...

GHSA-FV7X-V67W-CVQV Spring Data REST can expose hidden entity attributes

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

com.github.paulcwarren:content-rest-spring-boot-starter (>=2.4.0, <=2.5.0), com.github.paulcwarren:spring-content-rest (>=2.4.0, <=2.5.0) +30 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.7.0, <=3.7.2)

org.springframework.data:spring-data-rest-core MAVEN version =3.7.0, =2.4.0, =2.4.0, =2.4.0, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =1.1.4.release, =3.0.0, =3.0.4 and more Source cves: CVE-2022-31679 Source advisory: OSV:GHSA-FV7X-V67W-CVQV...

Spring Data REST can expose hidden entity attributes

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

com.github.paulcwarren:content-rest-spring-boot-starter (>=2.4.0, <=2.5.0), com.github.paulcwarren:spring-content-rest (>=2.4.0, <=2.5.0) +30 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.7.0, <=3.7.2)

org.springframework.data:spring-data-rest-core MAVEN version =3.7.0, =2.4.0, =2.4.0, =2.4.0, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =1.1.4.release, =3.0.0, =3.0.4 and more Source cves: CVE-2022-31679 Source advisory: GHSA-FV7X-V67W-CVQV...

app.commerce-io:spring-boot-starter-data-search-jpa (1.3.0), be.personify.iam:personify-api (>=1.3.2.release, <=1.4.4.release) +37 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.6.0, <=3.6.6)

org.springframework.data:spring-data-rest-core MAVEN version =3.6.0, =1.3.2.release, =1.3.1.release, =1.3.1.release, =1.2.6.release, =1.2.7, =1.2.7, =1.2.7, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 and more Source cves: CVE-2022-31679 Source advisory: OSV:GHSA-FV7X-V67W-CVQV...

app.commerce-io:spring-boot-starter-data-search-jpa (1.3.0), be.personify.iam:personify-api (>=1.3.2.release, <=1.4.4.release) +37 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.6.0, <=3.6.6)

org.springframework.data:spring-data-rest-core MAVEN version =3.6.0, =1.3.2.release, =1.3.1.release, =1.3.1.release, =1.2.6.release, =1.2.7, =1.2.7, =1.2.7, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 and more Source cves: CVE-2022-31679 Source advisory: GHSA-FV7X-V67W-CVQV...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

Code injection

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...