com.ibeetl:beetlsql (>=1.5.0, <=2.0), link.jfire:jfire-mvc (>=1.0, <=1.0.3) potentially affected by CVE-2023-30331 via com.ibeetl:beetl (2.2.8)

com.ibeetl:beetl MAVEN version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.ibeetl:beetl and may be impacted: - com.ibeetl:beetlsql =1.5.0, =1.0, =1.0.3 Source cves: CVE-2023-30331 Source advisory: OSV:GHSA-M69H-4FRQ-VWQ7...

cn.eova:eova (>=1.6-beta3, <=1.6.0), com.github.dennisit:vplus-core (1.1.3) +13 more potentially affected by CVE-2023-30331 via com.ibeetl:beetl (2.7.22)

com.ibeetl:beetl MAVEN version 2.7.22 is affected by a known vulnerability. The following packages have a transitive dependency on com.ibeetl:beetl and may be impacted: - cn.eova:eova =1.6-beta3, =1.0.5, =1.1.13.release, =1.0.1, =1.0.0, =0.3.1, =1.6-beta.2, =1.6-beta.2, =1.r.63, =1.r.63, =1.r.65...

com.github.dennisit:vplus-core (1.1.4), com.github.dennisit:vplus-data (1.1.4) +5 more potentially affected by CVE-2023-30331 via com.ibeetl:beetl (2.7.23)

com.ibeetl:beetl MAVEN version 2.7.23 is affected by a known vulnerability. The following packages have a transitive dependency on com.ibeetl:beetl and may be impacted: - com.github.dennisit:vplus-core 1.1.4 - com.github.dennisit:vplus-data 1.1.4 - com.github.dennisit:vplus-html 1.1.4 -...

com.github.dennisit:vplus-core (1.1.3), com.github.dennisit:vplus-data (1.1.3) +3 more potentially affected by CVE-2023-25330 via com.baomidou:mybatis-plus (2.1.1)

com.baomidou:mybatis-plus MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.baomidou:mybatis-plus and may be impacted: - com.github.dennisit:vplus-core 1.1.3 - com.github.dennisit:vplus-data 1.1.3 - com.github.dennisit:vplus-html...

GHSA-7PHW-CXX7-Q9VQ Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

DEBIAN-CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

UBUNTU-CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

CVE-2023-24108

MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package requirements.txt. This vulnerability allows attackers to access sensitive user information and execute arbitrary code...

Malicious Package

Overview bem-mvc-direct is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

SUSE CVE-2018-15756

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

SUSE CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

ChiKoi 1.0 Directory Traversal

==================================================================================================================================== | Title : ChiKoi version 1.0 Directory Traversal Vulnerability Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

cn.bjdd301:core-mvc (1.0.0), org.thlws:payment-bestpay (1.0.1) +1 more potentially affected by CVE-2023-24163 via cn.hutool:hutool-all (4.0.1)

cn.hutool:hutool-all MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-all and may be impacted: - cn.bjdd301:core-mvc 1.0.0 - org.thlws:payment-bestpay 1.0.1 - org.thlws:payment-wechat 1.0.3 Source cves: CVE-2023-2416...

cn.bjdd301:core-mvc (1.0.0), org.thlws:payment-bestpay (1.0.1) +1 more potentially affected by CVE-2023-24162 via cn.hutool:hutool-all (4.0.1)

cn.hutool:hutool-all MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-all and may be impacted: - cn.bjdd301:core-mvc 1.0.0 - org.thlws:payment-bestpay 1.0.1 - org.thlws:payment-wechat 1.0.3 Source cves: CVE-2023-2416...

cn.bjdd301:core-mvc (>=1.0.1, <=1.0.3), top.populus:bees (>=1.0.3, <=1.0.7) +6 more potentially affected by CVE-2023-24163 via cn.hutool:hutool-all (4.5.6)

cn.hutool:hutool-all MAVEN version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-all and may be impacted: - cn.bjdd301:core-mvc =1.0.1, =1.0.3, =1.0.5, =1.0.5, =1.0.5, =1.0.7 Source cves: CVE-2023-24163 Source advisory:...

This Week in Spring - January 17th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I went to Helsinki, Finland, last week, and this week I'm in Atlanta, Georgia, to speak at the Atlanta Java User Group. And, of course, next week, I'll be in New York to join a viewing party for the airing of SpringOne...

ChiKoi New-MVC-SHOP 1.0 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

CVE-2022-43484

TERASOLUNA Global Framework 1.0.0 Public review version and TERASOLUNA Server Framework for Java Rich 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.The vulnerability is caused by an...

Input validation

TERASOLUNA Global Framework 1.0.0 Public review version and TERASOLUNA Server Framework for Java Rich 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.The vulnerability is caused by an...