co.fingerprintsoft:notification-spring-boot-autoconfigure (1.0.10), co.fingerprintsoft:notification-spring-boot-starter (1.0.10) +146 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.8.release)

org.springframework.boot:spring-boot MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - co.fingerprintsoft:notification-spring-boot-autoconfigure 1.0.10 -...

co.fingerprintsoft:notification-spring-boot-autoconfigure (1.0.9), co.fingerprintsoft:notification-spring-boot-starter (1.0.9) +222 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.7.release)

org.springframework.boot:spring-boot MAVEN version 1.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - co.fingerprintsoft:notification-spring-boot-autoconfigure 1.0.9 -...

ch.sbb.releasetrain:action (0.0.25), ch.sbb.releasetrain:config (0.0.25) +229 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.3.6.release)

org.springframework.boot:spring-boot MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ch.sbb.releasetrain:action 0.0.25 - ch.sbb.releasetrain:config 0.0.25 -...

Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

EndpointRequest.to creates a matcher for null/ if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: You use Spring Security EndpointRequest.to has been used in a Spri...

co.paralleluniverse:comsat-spring-boot (0.3.0), com.bertramlabs.plugins:asset-pipeline-spring-boot (>=2.0.19, <=2.13.1) +49 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (1.1.9.release)

org.springframework.boot:spring-boot MAVEN version 1.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (>=0.2.0, <=0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +19698 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (>=3.0.0, <=3.4.4)

org.springframework.boot:spring-boot MAVEN version =3.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.12.1 and more Source cves: CVE-2025-22235 Source advisory: MEND:CVE-2025-22235...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.114.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +4254 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0, <=3.4.4)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =cloud-0.1, =0.6 - ai.ylyue:yue-library-base j17.3.3.1 - ai.ylyue:yue-library-base-crypto j17.3.3.1 and more Source...

CVE-2025-22235 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

EndpointRequest.to creates a matcher for null/ if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: You use Spring Security EndpointRequest.to has been used in a Spri...

CVE-2025-22235

CVE-2025-22235 : EndpointRequest.to() creates a matcher for /null when the actuator endpoint is disabled or not exposed. IBM advisories confirm this CVE as addressed by IBM Library Support for Spring: upgrade to fixed versions in the remediation table (e.g., IBM Library Support for Spring 6.2.x →...

CVE-2025-22235 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

EndpointRequest.to creates a matcher for null/ if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: You use Spring Security EndpointRequest.to has been used in a Spri...

VMware Spring Boot < 2.7.25, 3.0.x < 3.1.16, 3.2.x < 3.2.14, 3.3.x < 3.3.11, 3.4.x < 3.4.5 Matcher Vulnerability - Linux

VMware Spring Boot is prone to a matcher vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vmware:springboot";...

VMware Spring Boot < 2.7.25, 3.0.x < 3.1.16, 3.2.x < 3.2.14, 3.3.x < 3.3.11, 3.4.x < 3.4.5 Matcher Vulnerability - Windows

VMware Spring Boot is prone to a matcher vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vmware:springboot";...

PT-2025-18049

Name of the Vulnerable Software and Affected Versions Spring Boot version 2.7.x Description The issue arises when EndpointRequest.to creates a matcher for null/ if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. An application may be affected if ...

VMware Spring Boot security vulnerabilities

VMware Spring Boot is a set of open source frameworks from VMware, Inc. A security vulnerability exists in VMware Spring Boot that stems from EndpointRequest.to creating a null/ matcher when the endpoint is disabled or unexposed, which could lead to a security constraint bypass...

Spring-Boot-Admin injection vulnerability

spring-boot-admin is a codecentric open source based on Spring boot Mybatis open source backend management system , with user management , menu management and role management 3 functions , permission control to the button level . spring-boot-admin version 1.0 there are injection vulnerabilities ,...

ai.ancf.lmos:arc-runner (0.114.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +1570 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.4.0, <=3.4.4)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.4.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =1.10.0, =1.14.0 and more Source cves: CVE-2025-22235 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKBOOT-9804...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.112.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.4.0) +5224 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.7.0, <=3.3.10)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.7.0, =0.1.1, =0.0.4, =0.1.0, =cloud-0.1, =6.4.0, =1.1.0, =2.3.0, =1.1.0, =1.1.0, =2.10.0, =1.1.0, =1.1.0, =2.3.0, =1.1.0, =1.2.0 and more Source cves: CVE-2025-22235 Sou...

This Week in Spring - April 22nd, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring , which I'm writing from magnificent Minneapolis, Minnesota, where I'm recording an amazing Frontend Masters course introducing Spring Boot. I love this article introducing Spring AI in JavaPro magazine Want to run an LLM...

My-BBS security vulnerabilities

My-BBS is a SpringBoot + Mybatis + Thymeleaf technology implemented BBS forum system by ZHENFENG13 individual developer. A security vulnerability exists in My-BBS version 1.0, which stems from a cross-site request forgery issue...

📄 Spring Boot common-user-management 0.1 Shell Upload

Spring Boot common-user-management version 0.1 suffers from a remote shell upload vulnerability. Exploit Title: Unrestricted File Upload Google Dork: Date: 14/Nov/2024 Exploit Author: d3sca Vendor Homepage: https://github.com/OsamaTaher/Java-springboot-codebase Software Link:...