io.oasp.java.modules:oasp4j-batch (>=1.5.0, <=2.6.1), org.springframework.batch:spring-batch-integration (>=3.0.0.release, <=3.0.8.release) +29 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.5.release)

org.springframework:spring-messaging MAVEN version 4.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - io.oasp.java.modules:oasp4j-batch =1.5.0, =3.0.0.release, =1.1.0.release,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.4), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.4) +134 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.2.4.release)

org.springframework:spring-messaging MAVEN version 4.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.4 -...

org.springframework.batch:spring-batch-integration (3.0.9.release), org.springframework.boot:spring-boot-starter-integration (>=1.1.11.release, <=1.1.12.release) +27 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.9.release)

org.springframework:spring-messaging MAVEN version 4.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.springframework.batch:spring-batch-integration 3.0.9.release -...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dev-tools:ai-devtools (>=0.1.12, <=0.1.20) +26830 more potentially affected by CVE-2022-22970 via org.springframework:spring-beans (>=5.0.0.release, <=5.2.21.release)

org.springframework:spring-beans MAVEN version =5.0.0.release, =4.4.0.0, =0.1.12, =0.2, =0.2, =0.2, =0.2, =0.2, =0.2, =0.5, =0.0.12, =0.0.12, =0.1.2, =0.0.22, =0.0.22, =0.0.51 and more Source cves: CVE-2022-22970 Source advisory: OSV:GHSA-HH26-6XWR-GGV7...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +147 more potentially affected by CVE-2022-22970 via org.springframework:spring-beans (4.3.29.release)

org.springframework:spring-beans MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-beans and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate =2.3.12,...

This Week in Spring - May 10th, 2022

Hi, Spring fans! Im writing this from - I cant believe I get to say this - abroad! Im in London, UK! Now, this is not particularly noteworthy for those millions who already live here. But I dont live here. Im a visitor! I live in San Francisco. I had to fly here! On a plane! With other people!...

Exploit for Code Injection in Vmware Spring_Framework

漏洞简介 最近spring爆出重磅级CVE漏洞，cve信息显示"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot...

CVE-2022-28588

In SpringBootMovie =1.2 when adding movie names, malicious code can be stored because there are no filtering parameters, resulting in stored XSS...

SpringBootMovie Cross-Site Scripting Vulnerability

SpringBootMovie, a Spring Boot-based movie website, is vulnerable to a cross-site scripting vulnerability in SpringBootMovie version 1.2 and earlier, which stems from a failure to filter parameters when adding movie names. An attacker could exploit this vulnerability to execute JavaScript code on...

Exploit for Code Injection in Vmware Spring_Framework

漏洞简介 最近spring爆出重磅级CVE漏洞，cve信息显示"A Spring MVC or Spring WebFl...

This Week in Spring - April 26th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! This week I was hoping to be in glorious Chicago, Illinois for the first in-person SpringOne Tour installment since the pandemic. But, alas, I couldnt go because - out of an abundance of caution, and since I was exposed to...

VMware Spring Boot < 2.5.13, 2.6.x < 2.6.7 Data Binding Rules Vulnerability

VMware Spring Boot is prone to a data binding rules vulnerability in the used Spring Framework. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Spring Framework Data Binding Rules Vulnerability (CVE-2022-22968)

Table of Contents Overview Does This Affect My Application? Reassessing Your Data Binding Approach Overview While investigating the Spring Framework RCE vulnerability CVE-2022-22965 and the suggested workaround, we realized that the disallowedFields configuration setting on WebDataBinder is not...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.5.10 update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For...

com.yahoo.elide:elide-spring-boot-starter (6.1.3), com.yahoo.elide:elide-standalone (6.1.3) potentially affected by CVE-2022-24827 via com.yahoo.elide:elide-datastore-aggregation (6.1.3)

com.yahoo.elide:elide-datastore-aggregation MAVEN version 6.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.yahoo.elide:elide-datastore-aggregation and may be impacted: - com.yahoo.elide:elide-spring-boot-starter 6.1.3 -...

Security Bulletin: IBM Maximo For Civil infrastructure is vulnerable to a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Maximo For Civil infrastructure is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast t...

com.yahoo.elide:elide-spring-boot-starter (6.1.3), com.yahoo.elide:elide-standalone (6.1.3) potentially affected by CVE-2022-24827 via com.yahoo.elide:elide-datastore-aggregation (6.1.3)

com.yahoo.elide:elide-datastore-aggregation MAVEN version 6.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.yahoo.elide:elide-datastore-aggregation and may be impacted: - com.yahoo.elide:elide-spring-boot-starter 6.1.3 -...

com.yahoo.elide:elide-spring-boot-starter (6.1.3), com.yahoo.elide:elide-standalone (6.1.3) potentially affected by CVE-2022-24827 via com.yahoo.elide:elide-datastore-aggregation (6.1.3)

com.yahoo.elide:elide-datastore-aggregation MAVEN version 6.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.yahoo.elide:elide-datastore-aggregation and may be impacted: - com.yahoo.elide:elide-spring-boot-starter 6.1.3 -...

VMware Spring Boot Detection (Linux/Unix SSH Login)

SSH login-based detection of VMware Spring Boot and its components. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

VMware Spring Boot Detection Consolidation

Consolidation of VMware Spring Boot and its components detections. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...