com.studio4365:spring-boot-healthcheck (1.00), de.digitalcollections:iiif-server-demo (>=2.0.1, <=2.1.2) +48 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.2.6.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - com.studio4365:spring-boot-healthcheck 1.00 -...

org.springframework.boot:spring-boot-starter-data-rest (1.1.0.release), org.springframework.boot:spring-boot-starter-freemarker (1.1.0.release) +9 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.1.0.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +4 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.0.1.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - com.ebay:lightning-client 0.9.0 - com.ebay:lightning-co...

com.blitline:blitline-image-client-example (>=0.10.1, <=0.13.3), com.github.pjagielski.spring-boot-swagger:spring-boot-swagger (0.1) +11 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.0.2.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - com.blitline:blitline-image-client-example =0.10.1,...

io.fabric8:process-spring-boot-itests-invoicing (1.1.0.cr2), io.fabric8:process-spring-boot-itests-service-invoicing (1.1.0.cr2) +11 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.1.1.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing 1.1.0.c...

org.springframework.boot:spring-boot-starter-data-rest (1.1.2.release), org.springframework.boot:spring-boot-starter-freemarker (1.1.2.release) +9 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.1.2.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - org.springframework.boot:spring-boot-starter-data-rest...

io.fabric8:process-spring-boot-itests-invoicing (1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr3, <=1.1.0.cr5) +11 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.1.3.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing 1.1.0.c...

com.github.totyumengr:minicubes-cluster (0.2), com.kurento.kmf:kmf-broker (4.3.1) +30 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.1.4.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - com.github.totyumengr:minicubes-cluster 0.2 -...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (j11.2.6.0) +1765 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (>=2.6.0, <=2.6.5)

org.springframework.boot:spring-boot-starter-web MAVEN version =2.6.0, =4.4.0.2, =1.2.5.release, =0.1.2, =5.7.7, =5.7.7, =5.7.7, =1.0.0, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.313 and more Source cves: CVE-2022-22965 Source advisory: GHSA-36P3-WJMG-H94X...

au.com.mountain-pass:hyperstate (>=1, <=3), cc.catalysts.boot:cat-boot-thymeleaf (>=0.0.10, <=0.1.14) +61 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.3.2.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - au.com.mountain-pass:hyperstate =1, =0.0.10, =11.0.0,...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +10342 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (>=2.0.0.release, <=2.5.11)

org.springframework.boot:spring-boot-starter-web MAVEN version =2.0.0.release, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr4, =greenwich.sr2.1 and more Source cves: CVE-2022-22965 Source advisory:...

ai.ylyue:yue-library-webflux (j11.2.6.0), ca.gc.cyber.ops:assemblyline-java-client (>=1.7, <=1.8) +335 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-webflux (>=2.6.0, <=2.6.5)

org.springframework.boot:spring-boot-starter-webflux MAVEN version =2.6.0, =1.7, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =0.2.2, =1.1.3, =1.1.3, =3.12.0, =1.4.6, =0.1.0, =1.2.0 and more Source cves: CVE-2022-22965 Source advisory: GHSA-36P3-WJMG-H94X...

cn.dubby:itbus (>=0.2.7, <=0.2.8), cn.iq99:padb (0.0.6-release) +478 more potentially affected by CVE-2022-22965 via org.springframework.boot:spring-boot-starter-web (1.5.3.release)

org.springframework.boot:spring-boot-starter-web MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-web and may be impacted: - cn.dubby:itbus =0.2.7, =0.0.1-release, =1.0.0, =1.0.8,...

Exploit for Code Injection in Vmware Spring_Framework

CVE-2022-22965 aka "Spring4Shell" Vulnerabilidad RCE en Spri...

Directory Traversal

spring-boot is vulnerable to directory traversal. The vulnerability exists due to a lack of sanitization of access rights allowing an attacker to write to an embedded web server...

Spring Framework RCE via Data Binding on JDK 9+

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

VMware Spring Boot / Spring Framework Detection (HTTP)

HTTP based detection of VMware Spring Boot and the Spring Framework. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (CVE-2022-22965)

The remote host contains a Spring Framework library version that is prior to 5.2.20 or 5.3.x prior to 5.3.18. It is, therefore, affected by a remote code execution vulnerability: - A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data...

CVE-2022-27772

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...

CVE-2022-27772

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...