org.infinispan:infinispan-docs (12.0.0.dev04), org.infinispan:infinispan-javadoc-all (12.0.0.dev04) +7 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-cachestore-remote (12.0.0.dev04)

org.infinispan:infinispan-cachestore-remote MAVEN version 12.0.0.dev04 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-cachestore-remote and may be impacted: - org.infinispan:infinispan-docs 12.0.0.dev04 -...

org.apache.camel.springboot:camel-infinispan-embedded-starter (>=3.14.8, <=3.14.10), org.apache.camel.springboot:camel-infinispan-starter (>=3.14.8, <=3.14.10) +51 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-core (12.1.14.final)

org.infinispan:infinispan-core MAVEN version 12.1.14.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.apache.camel.springboot:camel-infinispan-embedded-starter =3.14.8, =3.14.8, =3.14.10 -...

cn.vertxup:aeon-ambient (0.9.0), cn.vertxup:aeon-aurora (0.9.0) +76 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-core (13.0.15.final)

org.infinispan:infinispan-core MAVEN version 13.0.15.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - cn.vertxup:aeon-ambient 0.9.0 - cn.vertxup:aeon-aurora 0.9.0 - cn.vertxup:aeon-code 0.9.0 -...

This Year in Spring - 2023

Welcome to another installment of This Week in Spring! It's December 26th, 2023, and we're staring down the new year! And you know what that means, right? It's time for our annual roundup, looking at all the latest and greatest in the wild and wonderful world of Springdom. This is This Year in...

Design/Logic Flaw

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue...

CVE-2023-51650 Unauthorized access vulnerability on three interfaces

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue...

CVE-2023-51650 Unauthorized access vulnerability on three interfaces

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue...

CVE-2023-51650: Missing Authorization

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue...

PT-2023-31868 · Hertzbeat · Hertzbeat

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is an open source, real-time monitoring system. Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces, potentially resulting in the...

Hertzbeat Security Vulnerabilities

Hertzbeat is an open source real-time monitoring system from the dromara organization. A security vulnerability exists in Hertzbeat versions prior to 1.4.1 that stems from a misconfiguration of Spring Boot permissions, resulting in unauthorized access vulnerabilities in three interfaces...

Spring Boot Improper Resource Cleanup DoS

The vulnerability of the Spring Boot web application framework lies in improper resource cleanup or release mechanisms. Exploiting this vulnerability allows an attacker to trigger a service failure through a specially crafted HTTP request...

This Week in Spring - December 19th, 2023

Hi, Spring fans! Welcome to another oh-so-festive edition of This Week in Spring! the Spring Authorization Server 1.2.1, 1.1.14, and 0.4.5, are now available Spring AMQP 3.1.1 is now available Spring Security 5.8.9, 6.1.6, 6.2.1 are now available Spring for Apache Kakfa 3.1.1 is now available...

org.apache.dubbo:dubbo-spring-boot-actuator (3.1.5), org.apache.dubbo:dubbo-spring-boot-actuator-compatible (3.1.5) +5 more potentially affected by CVE-2023-46279 via org.apache.dubbo:dubbo (3.1.5)

org.apache.dubbo:dubbo MAVEN version 3.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dubbo:dubbo and may be impacted: - org.apache.dubbo:dubbo-spring-boot-actuator 3.1.5 - org.apache.dubbo:dubbo-spring-boot-actuator-compatible 3.1.5 -...

org.apache.dubbo:dubbo-spring-boot-actuator (3.1.5), org.apache.dubbo:dubbo-spring-boot-actuator-compatible (3.1.5) +5 more potentially affected by CVE-2023-46279 via org.apache.dubbo:dubbo (3.1.5)

org.apache.dubbo:dubbo MAVEN version 3.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dubbo:dubbo and may be impacted: - org.apache.dubbo:dubbo-spring-boot-actuator 3.1.5 - org.apache.dubbo:dubbo-spring-boot-actuator-compatible 3.1.5 -...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2023-50100 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2023-50100 Source...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2023-50101 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2023-50101 Source...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2023-50102 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2023-50102 Source...

com.jfinal:jfinal-undertow (2.0), com.jfinal:jfinal-weixin (2.5) +5 more potentially affected by CVE-2023-50100 via com.jfinal:jfinal (4.8)

com.jfinal:jfinal MAVEN version 4.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 2.0 - com.jfinal:jfinal-weixin 2.5 - io.jboot:jboot =2.3.1, =3.1.0, =3.5.8.v20191228-release, =0.0.1...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2023-50137 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2023-50137 Source...

com.jfinal:jfinal-undertow (2.0), com.jfinal:jfinal-weixin (2.5) +5 more potentially affected by CVE-2023-50137 via com.jfinal:jfinal (4.8)

com.jfinal:jfinal MAVEN version 4.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 2.0 - com.jfinal:jfinal-weixin 2.5 - io.jboot:jboot =2.3.1, =3.1.0, =3.5.8.v20191228-release, =0.0.1...