IceCMS Cross-Site Scripting Vulnerability

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . IceCMS v1.0.0 version exists cross-site scripting vulnerability, the vulnerability stems from the application of the user-supplied data lack of effective filtering and escaping, an attacker can...

Spring Boot Welcome Page Denial of Service

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service DoS attack if Spring MVC is used together with a reverse proxy cache. Specifically, an application is vulnerable if all of the condition...

GHSA-XF96-W227-R7C4 Spring Boot Welcome Page Denial of Service

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service DoS attack if Spring MVC is used together with a reverse proxy cache. Specifically, an application is vulnerable if all of the condition...

com.github.attt:archer-spring-autoconfigure (1.0-rc1), com.github.attt:archer-spring-boot-starter (1.0-rc1) +22 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.0.0.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.github.attt:archer-spring-autoconfigure 1.0-rc1...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +24 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.0.1.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.ebay:lightning-client 0.9.0 -...

com.blitline:blitline-image-client-example (>=0.10.1, <=0.13.3), com.erudika:para (>=1.3.0, <=1.7.0) +36 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.0.2.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.blitline:blitline-image-client-example =0.10.1,...

org.springframework.boot:spring-boot-actuator (1.1.0.release), org.springframework.boot:spring-boot-docs (1.1.0.release) +28 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.0.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - org.springframework.boot:spring-boot-actuator...

io.fabric8:process-spring-boot-container (1.1.0.cr2), io.fabric8:process-spring-boot-itests-invoicing (1.1.0.cr2) +33 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.1.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - io.fabric8:process-spring-boot-container 1.1.0.cr2 ...

org.springframework.boot:spring-boot-actuator (1.1.2.release), org.springframework.boot:spring-boot-docs (1.1.2.release) +27 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.2.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - org.springframework.boot:spring-boot-actuator...

com.github.cafdataprocessing:boilerplate-api-web (>=2.0.0-5, <=2.3.0-92), com.github.cafdataprocessing:corepolicy-web (>=1.0.0-4, <=1.2.0-165) +35 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.3.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.github.cafdataprocessing:boilerplate-api-web...

com.erudika:para (1.8.0), com.github.totyumengr:minicubes-cluster (0.2) +54 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.4.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.erudika:para 1.8.0 -...

com.github.kmbulebu.nicknack:nicknack-server (0.0.4), com.github.relai.vertx.springdata:mod-spring-data (0.5) +43 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.5.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.github.kmbulebu.nicknack:nicknack-server 0.0.4 ...

com.bytebybyte:google-geocoding (>=3.0.0, <=3.0.1), com.bytebybyte:mapquest-open-geocoding (1.0.0) +59 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.6.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.bytebybyte:google-geocoding =3.0.0, =0.7, =0.8....

com.vilt-group.minium:minium-app (0.9.6), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +35 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.7.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.vilt-group.minium:minium-app 0.9.6 -...

com.blitline:blitline-image-client-example (>=0.14.0, <=0.14.3), com.erudika:para (>=1.9.0, <=1.11) +43 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.8.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.blitline:blitline-image-client-example =0.14.0,...

co.paralleluniverse:comsat-spring-boot (0.3.0), com.bertramlabs.plugins:asset-pipeline-spring-boot (>=2.0.19, <=2.13.1) +48 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.9.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

org.springframework.boot:spring-boot-actuator (1.1.10.release), org.springframework.boot:spring-boot-docs (1.1.10.release) +29 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.10.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - org.springframework.boot:spring-boot-actuator...

org.grails:grails-gsp-spring-boot (1.0.0), org.springframework.boot:spring-boot-actuator (1.1.11.release) +28 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.11.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - org.grails:grails-gsp-spring-boot 1.0.0 -...

com.definesys.mpaas:query-weblogic (1.0.0), io.github.sethdeveloper:fixed-asset-engine (>=0.1.4-jdk8-m2, <=0.2.3-monthly-daily-depre-jdk8) +29 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.12.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.definesys.mpaas:query-weblogic 1.0.0 -...

com.github.jlgrock.snp:client (0.1), com.github.jlgrock.snp:core (0.1) +77 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.2.0.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.github.jlgrock.snp:client 0.1 -...