com.ecfront.dew:monitor (1.2.2-rc), de.codecentric:spring-boot-admin-sample (1.5.4) +7 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.5.4)

de.codecentric:spring-boot-admin-server MAVEN version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - com.ecfront.dew:monitor 1.2.2-rc - de.codecentric:spring-boot-admin-sample 1.5.4 ...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24), cn.tworice:tworice-monitor-starter (>=1.2.3-release, <=1.5.3) +48 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (>=2.0.0, <=2.7.15)

de.codecentric:spring-boot-admin-server MAVEN version =2.0.0, =0.5.0, =1.2.3-release, =3.0.3.release, =1.0.0, =1.1.3, =3.0.10, =1.0.0, =5.0.18, =2.0.1, =2.0.1, =2.0.0, =2.7.15 and more Source cves: CVE-2023-38286 Source advisory: GHSA-7GJ7-224W-VPR3...

com.netcetera.girders.demos:girders-demo-adminserver (>=6.0.0-m2, <=6.1.0), com.senzhikong:depend-cloud-monitor (>=1.1.0, <=1.1.1) +11 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (>=3.0.0, <=3.1.1)

de.codecentric:spring-boot-admin-server MAVEN version =3.0.0, =6.0.0-m2, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.0-rc4, =7.0.0-rc6 Source cves: CVE-2023-38286 Source advisory: OSV:GHSA-7GJ7-224W-VPR3...

com.netcetera.girders.demos:girders-demo-adminserver (>=6.0.0-m2, <=6.1.0), com.senzhikong:depend-cloud-monitor (>=1.1.0, <=1.1.1) +11 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (>=3.0.0, <=3.1.1)

de.codecentric:spring-boot-admin-server MAVEN version =3.0.0, =6.0.0-m2, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =7.0.0-rc4, =7.0.0-rc6 Source cves: CVE-2023-38286 Source advisory: GHSA-7GJ7-224W-VPR3...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

Design/Logic Flaw

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf 3.1.1.RELEASE (used in Spring Boot Admin up to 3.1.1) is affected by a sandbox bypass via crafted HTML, enabling potential SSTI and code execution if MailNotifier is enabled with write access to environment variables in the UI. Affected products: Thymeleaf 3.1.1.RELEASE and Spring Boot ...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

CVE-2023-38286: Improper Neutralization of Special Elements used in a Command

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

PT-2023-26346 · Thymeleaf +1 · Thymeleaf +1

Name of the Vulnerable Software and Affected Versions: Thymeleaf versions 3.1.1.RELEASE and earlier spring-boot-admin versions 3.1.1 and earlier Description: The issue allows for a sandbox bypass via crafted HTML, which may be relevant for Server Side Template Injection SSTI and code execution in...

A Bootiful Podcast: Spring Framework and Spring Boot legend Stéphane Nicoll on a Bootiful Podcast

Hi, Spring fans! Welcome to another installment of A Bootiful Podcast! In this installment, Josh Long talk to Spring team legend Stéphane Nicoll @snicoll about Spring Boot, Apache Maven and Gradle, his journey to the Spring team, and so much more. This episode was recorded live from beautiful...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restriction bypass in VMware Tanzu Spring Boot (CVE-2023-20873)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restriction bypass in VMware Tanzu Spring Boot, caused by a flaw with wildcard pattern matching when deployed on Cloud Foundry CVE-2023-20873. VMware Tanzu Spring Boot is used as part of our Speech...

This Week in Spring - July 11th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in yummy, sunny Jakarta, Indonesia at the moment, preparing for a week of meetings and the SpringOne Tour Indonesia event later this week. I'll also be speaking in Kuala Lumpur, Malaysia on July 20th, 2023 . If you're in...

spring-boot: Spring Boot Welcome Page DoS Vulnerability

A flaw was found in Spring Boot, occurring prominently in Spring MVC with a reverse proxy cache. This issue requires Spring MVC to have auto-configuration enabled and the application to use Spring Boot's welcome page support, either static or templated, resulting in the application being deployed...

Critical: Red Hat Security Advisory: Red Hat Fuse 7.12 release and security update

A minor version update from 7.11 to 7.12 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in VMware Tanzu Spring Boot

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of VMware Tanzu Spring Boot. Vulnerability Details CVEID:CVE-2023-20873 DESCRIPTION: VMware Tanzu Spring Boot could allow a remote attacker to bypass security restrictions, caused by a flaw with wildca...