org.bonitasoft.engine:bonita-engine-spring-boot-starter (8.0.0), org.bonitasoft.engine:bonita-engine-standalone (8.0.0) +2 more potentially affected by CVE-2024-27609 via org.bonitasoft.platform:platform-resources (8.0.0)

org.bonitasoft.platform:platform-resources MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.platform:platform-resources and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 8.0.0 -...

org.bonitasoft.connectors:bonita-connector-rest (>=1.4.0, <=1.5.1), org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.14.0) +3 more potentially affected by CVE-2024-27609 via org.bonitasoft.platform:platform-resources (7.14.0)

org.bonitasoft.platform:platform-resources MAVEN version 7.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.platform:platform-resources and may be impacted: - org.bonitasoft.connectors:bonita-connector-rest =1.4.0, =1.5.1 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.11.4), org.bonitasoft.engine:bonita-engine-standalone (7.11.4) +2 more potentially affected by CVE-2024-27609 via org.bonitasoft.platform:platform-resources (7.11.4)

org.bonitasoft.platform:platform-resources MAVEN version 7.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.platform:platform-resources and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.11.4 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.10.1), org.bonitasoft.engine:bonita-engine-standalone (7.10.1) +2 more potentially affected by CVE-2024-27609 via org.bonitasoft.platform:platform-resources (7.10.1)

org.bonitasoft.platform:platform-resources MAVEN version 7.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.platform:platform-resources and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.10.1 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.12.1), org.bonitasoft.engine:bonita-engine-standalone (7.12.1) +2 more potentially affected by CVE-2024-27609 via org.bonitasoft.platform:platform-resources (7.12.1)

org.bonitasoft.platform:platform-resources MAVEN version 7.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.platform:platform-resources and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.12.1 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.11.3), org.bonitasoft.engine:bonita-engine-standalone (7.11.3) +2 more potentially affected by CVE-2024-27609 via org.bonitasoft.platform:platform-resources (7.11.3)

org.bonitasoft.platform:platform-resources MAVEN version 7.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.platform:platform-resources and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.11.3 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (7.9.3), org.bonitasoft.engine:bonita-engine-standalone (7.9.3) +2 more potentially affected by CVE-2024-27609 via org.bonitasoft.platform:platform-resources (7.9.3)

org.bonitasoft.platform:platform-resources MAVEN version 7.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.bonitasoft.platform:platform-resources and may be impacted: - org.bonitasoft.engine:bonita-engine-spring-boot-starter 7.9.3 -...

org.bonitasoft.engine:bonita-engine-spring-boot-starter (>=10.0.0, <=10.1.0), org.bonitasoft.engine:bonita-engine-standalone (>=10.0.0, <=10.1.0) +2 more potentially affected by CVE-2024-27609 via org.bonitasoft.platform:platform-resources (>=10.0.0, <=10.1.0)

org.bonitasoft.platform:platform-resources MAVEN version =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.1.0 Source cves: CVE-2024-27609 Source advisory: OSV:GHSA-8VJ9-5V5Q-FHCH...

Shanghai Brad Technology BladeX SQL Injection Vulnerability

Shanghai Brad Technology BladeX is a SpringBoot Rapid Development Platform from Shanghai Brad Technology Shanghai, China. A SQL injection vulnerability exists in Shanghai Brad Technology BladeX version 3.4.0, which originates from a SQL injection vulnerability in file/api/blade-user/export-user...

This Week in Spring - March 26th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! Sam Brannen shares some good news: a null-safe Index operator for the Spring Expression Language SpEL is coming to Spring Framework 6.2! This is interesting, and a nice application of AI do I even need to spell out "artificia...

Spring Tips: the Exposed ORM for Kotlin

Hi, Spring fans! In this installment we look at the Exposed Object Relational Mapper framework for Kotlin. Kotlin Java JDBC springboot...

Hello, Java 22!

update I've since published a Spring Tips video on this very topic! If you'd prefer, you could watch that instead. Hi, Spring fans! Happy Java 22 release day, to those who celebrate! Did you get the bits already? Go, go, go! Java 22 is a significant improvement that I think is a worthy upgrade fo...

VMware Spring Boot < 2.7.20.1, 3.0.x < 3.0.15.1, 3.1.x < 3.1.10, 3.2.x < 3.2.4 SSRF Vulnerability - Linux

VMware Spring Boot is prone to a server-side request forgery SSRF in the used Spring Framework. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

VMware Spring Boot < 2.7.20.1, 3.0.x < 3.0.15.1, 3.1.x < 3.1.10, 3.2.x < 3.2.4 SSRF Vulnerability - Windows

VMware Spring Boot is prone to a server-side request forgery SSRF in the used Spring Framework. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), com.apigee.edge.config:apigee-config-maven-plugin (>=1.3, <=2.2.2) +337 more potentially affected by CVE-2024-22259 via org.springframework:spring-web (4.3.20.release)

org.springframework:spring-web MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter 0.1.8 -...

Hypermedia and Browser Enhancement

Front end development these days is dominated by large JavaScript client side frameworks. There are plenty of good reasons for that, but it can be very inefficient for many use cases, and the framework engineering has become extremely complex. In this article, I want to explore a different...

This Week in Spring - March 12th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it's going to be! Do this first: we need your help! Please answer some questions in our State of Spring survey! Join me for a look at the latest-and-greatest, chronicling how I got started with Spring Boot in...

Spring Tips: Spring Batch Remote Partitioning, your easy button for data scale!

Hi, Spring fans! In this installment, Spring Developer Advocate Josh Long looks at how to use Spring Batch's remote partitioning support to easy-button your data processing scale out strategies. postgresql ai datascience data springboot java java21...

Apache Shiro Spring Boot Authentication Bypass

The vulnerability of the Apache Shiro framework and the Spring Boot framework for creating web applications is related to the occurrence of interpretation conflicts. Exploiting this vulnerability can allow a malicious actor to bypass authentication procedures using a specially crafted HTTP reques...

Bootiful Spring Boot in 2024 (part 1)

NB: the code is here on my Github account: github.com/joshlong/bootiful-spring-boot-2024-blog. Hi, Spring fans! I'm Josh Long, and I work on the Spring team. I'm excited to be keynoting and giving a talk at Microsoft's JDConf this year. I'm a Kotlin GDE and a Java Champion, and I'm of the opinion...