Denial Of Service (DoS)

Spring Boot is vulnerable to Denial Of Service. The vulnerability is due to parsing malicious HTTP Request without proper validation or sanitization. This issue can be exploited by an attacker via crafting mailicous HTTP Request leading to Denial Of Service. Note that the following conditions mus...

com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9), com.bstek.ureport:ureport2-font (>=2.0.0, <=2.0.1) +13 more potentially affected by CVE-2023-48848 via com.bstek.ureport:ureport2-core (>=2.0.0, <=2.2.9)

com.bstek.ureport:ureport2-core MAVEN version =2.0.0, =2.0.0, =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2023-48848 Source advisory: GHSA-9VFC-QXC8-WRPQ...

CVE-2023-34055

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring M...

CVE-2023-34053

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC or Spring WebFlux...

GHSA-V94H-HVHG-MF9H Spring Framework vulnerable to denial of service

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC or Spring WebFlux...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-fragmentisers (>=1.1.0, <=3.4.0) +1437 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (>=3.1.0, <=3.1.5)

org.springframework.boot:spring-boot-actuator MAVEN version =3.1.0, =1.1.0, =2.3.0, =1.1.0, =1.1.0, =2.10.0, =1.1.0, =1.1.0, =2.3.0, =1.1.0, =1.1.0, =1.1.0, =2.3.0, =3.6.0, =3.6.1 - be.vlaanderen.informatievlaanderen...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +68 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.3.0.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-start...

com.github.zed-platform:zed-service-attachment-file (0.0.20), com.github.zed-platform:zed-service-document-elasticsearch (0.0.20) +30 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.2.2.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.zed-platform:zed-service-attachment-file 0.0.20 -...

com.alibaba.spring.boot:dubbo-spring-boot-starter (>=1.0.1, <=2.0.0), com.almis.awe:awe-annotation (>=4.1.0, <=4.1.1) +171 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.10.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.alibaba.spring.boot:dubbo-spring-boot-starter =1.0.1,...

ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +7126 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (>=2.0.0.release, <=2.7.17)

org.springframework.boot:spring-boot-actuator MAVEN version =2.0.0.release, =0.1.2, =0.5.0, =0.5.21, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2023-34055 Source advisory:...

com.alibaba:tac-console (0.0.4), com.alibaba:tac-container (0.0.4) +26 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.4.7.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.alibaba:tac-console 0.0.4 - com.alibaba:tac-container 0.0...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +27 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.4.4.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: -...

com.garethahealy.poms:springboot-parent (1.0.0), com.garethahealy:springboot-parent (>=1.0.7, <=1.1.1) +32 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.3.1.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.garethahealy.poms:springboot-parent 1.0.0 -...

com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1), de.codecentric:spring-boot-admin-sample (>=1.1.0, <=1.1.1) +6 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.9.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.bushidowallet:bushido-wallet-service =1.0.0, =1.1.0,...

com.vilt-group.minium:minium-app (0.9.6), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +6 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.7.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.vilt-group.minium:minium-app 0.9.6 -...

com.17jee:e-cloud-gateway (3.0.0.release), com.17jee:e-cloud-oauth (3.0.0.release) +27 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.3.6.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.17jee:e-cloud-gateway 3.0.0.release -...

de.codecentric:spring-boot-admin-example (1.0.2), de.codecentric:spring-boot-admin-server (1.0.2) +10 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.6.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - de.codecentric:spring-boot-admin-example 1.0.2 -...

org.springframework.boot:spring-boot-docs (1.1.1.release), org.springframework.boot:spring-boot-starter-actuator (1.1.1.release) +1 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.1.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - org.springframework.boot:spring-boot-docs 1.1.1.release -...

com.github.totyumengr:minicubes-cluster (0.2), de.codecentric:spring-boot-starter-batch-web (1.1.0.release) +6 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.4.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.totyumengr:minicubes-cluster 0.2 -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.10, <=0.0.14), com.github.mthizo247:spring-cloud-netflix-zuul-websocket (>=1.0.0-release, <=1.0.5.release) +72 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.3.3.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: -...