CVE-2023-38504

Sails (Node.js) CVE-2023-38504 affects apps before v1.5.7. An attacker could send a virtual request that crashes the node process, enabling a Denial of Service. The issue is fixed in v1.5.7. As a workaround, disable the sockets hook and remove the sails.io.js client.

CVE-2023-38504 Sails DoS vulnerability for apps with sockets enabled

Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the sails.io.js client...

CVE-2022-43712

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

CVE-2022-43712: Missing Authorization

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

CVE-2022-43712

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

Exploit for SQL Injection in Apache Log4J

CVE-2022-23305 Log4j JDBCAppender sql injection POC This is a...

Authorization Rule Misconfiguration

spring-security-config is vulnerable to Authorization Rule Misconfiguration. The vulnerability exists due to the lack of validation in the RequestMatcher of AbstractRequestMatcherRegistry.java when the application uses the requestMatchersString function with multiple servlets, one of them being...

Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

CVE-2023-34035: Incorrect Authorization

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

spring-boot: Spring Boot Welcome Page DoS Vulnerability

A flaw was found in Spring Boot, occurring prominently in Spring MVC with a reverse proxy cache. This issue requires Spring MVC to have auto-configuration enabled and the application to use Spring Boot's welcome page support, either static or templated, resulting in the application being deployed...

org.noear:beetlsql-solon-plugin (1.0.42), org.noear:cron4j-solon-plugin (1.0.42) +45 more potentially affected by CVE-2023-35839 via org.noear:solon (1.0.42)

org.noear:solon MAVEN version 1.0.42 is affected by a known vulnerability. The following packages have a transitive dependency on org.noear:solon and may be impacted: - org.noear:beetlsql-solon-plugin 1.0.42 - org.noear:cron4j-solon-plugin 1.0.42 - org.noear:dubbo-solon-plugin 1.0.42 -...

org.noear:cron4j-solon-plugin (1.0.15), org.noear:dubbo-solon-plugin (1.0.15) +41 more potentially affected by CVE-2023-35839 via org.noear:solon (1.0.15)

org.noear:solon MAVEN version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.noear:solon and may be impacted: - org.noear:cron4j-solon-plugin 1.0.15 - org.noear:dubbo-solon-plugin 1.0.15 - org.noear:mybatis-solon-plugin 1.0.15 -...

org.noear:beetlsql-solon-plugin (1.0.33), org.noear:cron4j-solon-plugin (1.0.33) +43 more potentially affected by CVE-2023-35839 via org.noear:solon (1.0.33)

org.noear:solon MAVEN version 1.0.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.noear:solon and may be impacted: - org.noear:beetlsql-solon-plugin 1.0.33 - org.noear:cron4j-solon-plugin 1.0.33 - org.noear:dubbo-solon-plugin 1.0.33 -...

org.noear:solon-api (1.0.3.33), org.noear:solon-mvc (1.0.3.33) +20 more potentially affected by CVE-2023-35839 via org.noear:solon (1.0.3.33)

org.noear:solon MAVEN version 1.0.3.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.noear:solon and may be impacted: - org.noear:solon-api 1.0.3.33 - org.noear:solon-mvc 1.0.3.33 - org.noear:solon.boot.jetty 1.0.3.33 - org.noear:solon.boot.jlhtt...

org.noear:solon-api (1.0.3.41), org.noear:solon-mvc (1.0.3.41) +23 more potentially affected by CVE-2023-35839 via org.noear:solon (1.0.3.41)

org.noear:solon MAVEN version 1.0.3.41 is affected by a known vulnerability. The following packages have a transitive dependency on org.noear:solon and may be impacted: - org.noear:solon-api 1.0.3.41 - org.noear:solon-mvc 1.0.3.41 - org.noear:solon.boot.jetty 1.0.3.41 - org.noear:solon.boot.jlhtt...

org.noear:cron4j-solon-plugin (1.0.4.3), org.noear:dubbo-solon-plugin (1.0.4.3) +31 more potentially affected by CVE-2023-35839 via org.noear:solon (1.0.4.3)

org.noear:solon MAVEN version 1.0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.noear:solon and may be impacted: - org.noear:cron4j-solon-plugin 1.0.4.3 - org.noear:dubbo-solon-plugin 1.0.4.3 - org.noear:mqtt-solon-plugin 1.0.4.3 -...