cloud.altemista.fwk.microservices:cloud-altemistafwk-core-microservices-zipkin-conf (>=3.0.0.release, <=3.0.1.release), cn.cocook:cocook-mvc (1.0.3) +109 more potentially affected by CVE-2021-3690 via io.undertow:undertow-core (1.4.25.final)

io.undertow:undertow-core MAVEN version 1.4.25.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cloud.altemista.fwk.microservices:cloud-altemistafwk-core-microservices-zipkin-conf =3.0.0.release,...

CVE-2022-31512

The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31512

The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31512

CVE-2022-31512 affects the Atom02/flask-mvc repository up to 2020-09-14, where an unsafe use of Flask’s send_file enables absolute path traversal. This can allow a remote attacker to view arbitrary files or cause a denial of service. The vulnerability is confirmed across multiple sources (NVD, Re...

CVE-2022-31512

The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31512: Improper Limitation of a Pathname to a Restricted Directory

The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

PT-2022-20782

Name of the Vulnerable Software and Affected Versions Atom02/flask-mvc versions prior to 2020-09-14 Description The issue allows absolute path traversal due to the unsafe use of the Flask send file function. Recommendations For versions prior to 2020-09-14, update to a version that safely utilize...

Flask-MVC path traversal vulnerability

flask-mvc is a repository by the individual developer Candra Nur Ihsan. A security vulnerability exists in flask-mvc version 2020-09-14 and earlier versions, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

Malware in bem-mvc

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in bem-mvc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 886727b00d8e66e121f2350c44e83e198483450ff7c986720bb268dc9907ffeb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Dell Wyse Management Suite < 3.6.1 Multiple Vulnerabilities (DSA-2022-098)

The version of Dell Wyse Management Suite installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2022-098 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to...

cn.cocook:cocook-mvc (>=0.0.4, <=1.0.2), com.networknt:audit (>=1.0.1, <=1.2.3) +81 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.4.4.final)

io.undertow:undertow-core MAVEN version 1.4.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.cocook:cocook-mvc =0.0.4, =1.0.1, =1.2.2, =1.0.1, =1.0.1, =1.2.2, =1.2.0, =1.1.0, =1.2.0, =1.1.0,...

Preparing for Spring Boot 3.0

Spring Boot 2.0 was the first release in the 2.x line and was published on Feburary 28th 2018. Weve just released Spring Boot 2.7 which means that, so far, weve been maintaining the 2.x line for just over 4 years. In total weve published 95 distinct releases over that timeframe! The entire Spring...

Improper Access Control in Telerik Extensions

Telerik Extensions for ASP.NET MVC all versions does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory. NOTE: this product has been obsolete since June 2013...

GHSA-8H7P-QJV8-9MP4 Improper Access Control in Telerik Extensions

Telerik Extensions for ASP.NET MVC all versions does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory. NOTE: this product has been obsolete since June 2013...

Cross-Site Request Forgery in Spring Framework

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External...

Exploit for Code Injection in Vmware Spring_Framework

漏洞简介 最近spring爆出重磅级CVE漏洞，cve信息显示"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot...

URL Rewrite vulnerability in multiple zendframework components

zend-diactoros and, by extension, Expressive, zend-http and, by extension, Zend Framework MVC projects, and zend-feed specifically, its PubSubHubbub sub-component each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request...

spring-framework: RCE via Data Binding on JDK 9+

A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, transitively affected from Spring Beans, using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain...

spring-framework: RCE via Data Binding on JDK 9+

A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, transitively affected from Spring Beans, using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain...