Security Bulletin: Java Spring vulnerability impacts IBM Watson Knowledge Catalog in Cloud Pak for Data (CVE-2022-22965)

Summary IBM Watson Knowledge Catalog in Cloud Pak for Data is potentially vulnerable to arbitrary code execution due to Java Spring data binding vulnerability CVE-2022-22965. Vulnerability Details CVEID:CVE-2022-22965 DESCRIPTION: Spring Framework could allow a remote attacker to execute arbitrar...

Security Patch Releases for Critical Zero-Day Bug in Java Spring Framework

The maintainers of Spring Framework have released an emergency patch to address a newly disclosed remote code execution flaw that, if successfully exploited, could allow an unauthenticated attacker to take control of a targeted system. Tracked as CVE-2022-22965, the high-severity flaw impacts...

Unpatched Java Spring Framework 0-Day RCE Bug Threatens Enterprise Web Apps Security

A zero-day remote code execution RCE vulnerability has come to light in the Spring framework shortly after a Chinese security researcher briefly leaked a proof-of-concept PoC exploit on GitHub before deleting their account. According to cybersecurity firm Praetorian, the unpatched flaw impacts...

CVE-2021-37694

@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream SCSt microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and al...

CVE-2021-37694 Code injection issue for java-spring-cloud-stream-template

@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream SCSt microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and al...

CVE-2021-37694: Improper Control of Generation of Code

@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream SCSt microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and al...

PT-2021-21814

Name of the Vulnerable Software and Affected Versions @asyncapi/java-spring-cloud-stream-template versions prior to 0.7.0 Description The issue allows for arbitrary code injection when an attacker controls the AsyncAPI document. This can be achieved by manipulating the operationId field in the...

Improper Authentication in Atlassian Connect Spring Boot

Broken Authentication in Atlassian Connect Spring Boot ACSB in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Sprin...

CVE-2021-26077

Broken Authentication in Atlassian Connect Spring Boot ACSB in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Sprin...

CVE-2021-26077

Broken Authentication in Atlassian Connect Spring Boot ACSB in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Sprin...

CVE-2021-26074

Broken Authentication in Atlassian Connect Spring Boot ACSB from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a...

Authentication flaw

Broken Authentication in Atlassian Connect Spring Boot ACSB from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a...

CVE-2021-26074

Broken Authentication in Atlassian Connect Spring Boot ACSB from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a...

CVE-2021-26074

Broken Authentication in Atlassian Connect Spring Boot ACSB from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a...

Michael Stepankin OpenID-Connect-Java-Spring-Server Server-Side Request Forgery Vulnerability

Michael Stepankin OpenID-Connect-Java-Spring-Server is a GlobalMichael Stepankin open source application system provides OpenID Connect identity provider and generic OAuth 2.0 authorization server Michael Stepankin OpenID-Connect-Java-Spring-Server suffers from a server-side request forgery...

Michael Stepankin OpenID-Connect-Java-Spring-Server 代码问题漏洞

Michael Stepankin OpenID-Connect-Java-Spring-Server is a GlobalMichael Stepankin open source application system provides OpenID Connect identity provider and generic OAuth 2.0 authorization server Michael Stepankin OpenID-Connect-Java-Spring-Server suffers from a server-side request forgery...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +42689 more potentially affected by CVE-2020-36179 via com.fasterxml.jackson.core:jackson-databind (>=2.7.0, <=2.9.10.7)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.7.0, =1.0.0, =0.3.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.42.1, =0.42.1, =0.80.6 and more Source cves: CVE-2020-36179 Source advisory:...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +31298 more potentially affected by CVE-2020-14062 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-14062 Source advisory:...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +30947 more potentially affected by CVE-2020-11113 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.3)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-11113 Source advisory:...

MITREid 1.3.3 Cross Site Scripting

MITREid Connect OpenID-Connect-Java-Spring-Server version 1.3.3 and earlier is vulnerable to Cross-Site Scripting; the users name is included in topbar.tag and header.tag without being sanitized. A user can set their name to a value like: Testalert1 Which will be included in JSON used by a...