SpringBoot-Blog Cross-Site Scripting Vulnerabilities

SpringBoot-Blog is a Java blogging system for wand individual developers. A security vulnerability exists in SpringBoot-Blog version 1.0, which originates from the parameter content in file src/main/java/com/my/blog/website/controller/admin/PageController.java that can lead to a cross-site...

cy-fast injection vulnerability

cy-fast is a SpringBoot based rapid development framework by chenyi personal developer. An injection vulnerability exists in cy-fast version 1.0, which is caused by SQL injection in the parameter order...

cy-fast injection vulnerability

cy-fast is a SpringBoot based rapid development framework by chenyi personal developer. An injection vulnerability exists in cy-fast version 1.0, which is caused by SQL injection in the parameter order...

Hello DCO, Goodbye CLA: Simplifying Contributions to Spring

The Spring team will be rolling out a simplified contribution process that replaces the requirement to sign a Contributor License Agreement CLA with a Developer Certificate of Origin DCO. The process will start this week with Spring Framework, Spring Security, & Spring Boot and then roll out to t...

My-Blog code issues and vulnerabilities

My-Blog is a Java blog system implemented by SpringBoot + Mybatis + Thymeleaf and other technologies, with beautiful pages, full functionality, easy deployment and perfect code. A code issue vulnerability exists in My-Blog version 1.0, which stems from improper handling of the file parameter,...

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

ai.acolite:openai-agent-sdk (>=0.1.0, <=0.4.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +19919 more potentially affected by CVE-2024-12801 via ch.qos.logback:logback-core (>=1.4.0, <=1.5.12)

ch.qos.logback:logback-core MAVEN version =1.4.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.9.0 - ai.chat2db.excel:easyexcel-plus-test 0.0.1 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 -...

Under the Radar: Exploring Spring Boot Actuator Misconfigurations

Wiz Threat Research investigates misconfigurations in Spring Boot Actuator’s endpoints that can leak environment variables, passwords, and API keys, and even lead to remote code execution...

Exploit for CVE-2024-38819

CVE-2024-38819: Proof of Concept PoC This is a proof of con...

Introducing Spring AI Amazon Bedrock Nova Integration via Converse API

The Amazon Bedrock Nova models represent a new generation of foundation models supporting a broad range of use cases, from text and image understanding to video-to-text analysis. With the Spring AI Bedrock Converse API integration, developers can seamlessly connect to these advanced Nova models a...

A Bootiful Podcast: Spring Security lead Rob Winch on the amazing Spring Security 6.4 release

Hi, Spring fans! In this installment, we'll talk to the amazing Rob Winch, lead of Spring Security 6.4, about the jam-packed new release! spring springboot security java...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.8 for Spring Boot security update.

Red Hat build of Apache Camel 4.8 for Spring Boot release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

com.kakawait:cas-security-dynamic-service-resolver (>=0.1.0, <=0.4.0), com.kakawait:cas-security-spring-boot-autoconfigure (>=0.1.0, <=0.3.2) +9 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-cas (>=4.2.2.release, <=4.2.14.release)

org.springframework.security:spring-security-cas MAVEN version =4.2.2.release, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =9.4.0.10, =2.3.0, =2.3.0, =5.20.2, =5.21.1, =5.22.7 Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

com.lt-peacock:webdbviewer (>=1.0.0, <=1.0.2), ee.telekom.workflow:workflow-web (>=1.5.0, <=1.6.3) +5 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-taglibs (>=5.7.1, <=5.7.13)

org.springframework.security:spring-security-taglibs MAVEN version =5.7.1, =1.0.0, =1.5.0, =4.7.0, =4.7.0, =5.2.7, =5.7.2.release, =5.7.2.release, =5.7.4.release Source cves: CVE-2024-38827 Source advisory: MEND:CVE-2024-38827...

HTTP/3 support in Reactor 2024.0 Release Train

HTTP/3, the latest major version of the Hypertext Transfer Protocol, had its specification finalized in June 2022. This version is designed to enhance performance, reliability, and security. Unlike its predecessors, HTTP/3 utilizes QUIC instead of TCP as its transport layer. QUIC is a UDP-based,...

This Week in Spring - November 26th, 2024

This Week in Spring - November 26th, 2024 Hi, Spring fans! Welcome to another installment of This Week in Spring! Happy Spring Boot 3.4 release month to those who celebrate! And, also, Happy Thanksgiving to those who celebrate! Spring Boot 3.4 brings with it long-anticipated updates to the entire...

Bootiful Spring Boot 3.4: Start Here

Hi, Spring fans! And happy Spring Boot 3.4 release to those who celebrate! I know, I know what you're thinking: Josh, Spring Boot 3.4 already shipped! I know it. Spring Boot 3.4 dropped a week earlier this year! In the last couple of years, we’ve released Spring Boot on the same day as Thanksgivi...

This Week in Spring - November 19th, 2024

Hi, Spring fans! How are you? Can you believe we're already staring at the end of the month? It's that time of the year when we see new releases, and the new releases reflect that frenzy! Soon: Spring Boot 3.4.0! Are you updated? Make sure you're updated! Remember: Spring projects leave open sour...

com.github.gmcoringa:coordinator (0.0.1), io.undertow:undertow-servlet (1.1.3.final) +4 more potentially affected by CVE-2023-4639 via io.undertow:undertow-core (1.1.3.final)

io.undertow:undertow-core MAVEN version 1.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.gmcoringa:coordinator 0.0.1 - io.undertow:undertow-servlet 1.1.3.final -...

com.github.dkubiak:goldfish-collector-maven (1.0), com.github.dkubiak:goldfish-server (1.0) +3 more potentially affected by CVE-2023-4639 via io.undertow:undertow-core (1.1.4.final)

io.undertow:undertow-core MAVEN version 1.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.dkubiak:goldfish-collector-maven 1.0 - com.github.dkubiak:goldfish-server 1.0 -...