Directory traversal

UNSUPPORTED WHEN ASSIGNED spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects...

CVE-2022-27772

CVE-2022-27772 : Spring Boot before v2.2.11.RELEASE is vulnerable to temporary directory hijacking via the method org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir. A local attacker could leverage this to escalate privileges or take over the application, as de...

CVE-2022-27772

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...

CVE-2022-27772

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.djl.spring:djl-spring-boot-starter-autoconfigure (>=0.2, <=0.5) +18197 more potentially affected by CVE-2022-27772 via org.springframework.boot:spring-boot (>=1.0.0.release, <=2.2.10.release)

org.springframework.boot:spring-boot MAVEN version =1.0.0.release, =4.4.0.0, =0.2, =0.2, =0.2, =0.2, =0.2, =0.2, =0.0.12, =0.1.8, =0.1.6, =0.1.2, =0.0.6, =0.0.11, =0.0.51 and more Source cves: CVE-2022-27772 Source advisory: MEND:CVE-2022-27772...

CVE-2022-27772

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...

VMware Spring Boot security vulnerabilities

VMware Spring Boot is an open source framework from VMware. A security vulnerability exists in VMware Spring Boot versions prior to 2.2.11, which stems from vulnerability to temporary directory hijacking...

CVE-2022-27772: Exposure of Resource to Wrong Sphere

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...

PT-2022-18576 · Spring +2 · Spring Boot +2

Name of the Vulnerable Software and Affected Versions: spring-boot versions prior to version v2.2.11.RELEASE Description: The issue is related to temporary directory hijacking, impacting the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. This...

This Week in Spring - March 29th, 2022

Aloha, Spring fans, from beautiful Maui, Hawaii, where I am with my family on a bit of vacation. Its our daughters Spring break and so were enjoying the family time while we can get it! I wanted to take a brief interlude in between the never-enough time on the beach and all the rum to get this...

CVE report published for Spring Framework

We have released Spring Framework 5.3.17 and Spring Framework 5.2.20 to address the following CVE report. CVE-2022-22950: Spring Expression DoS Vulnerability Please review the information in the CVE report and upgrade immediately. Spring Boot users should upgrade to 2.5.11 or 2.6.5...

Spring Boot Actuator Logview < 0.2.13 Directory Traversal

Spring Boot Actuator Logview is a library that adds a simple logfile viewer as Spring Boot Actuator endpoint. In Spring Boot Actuator Logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin Spring Boot...

Spring Boot Actuator HikariCP Remote Code Execution

The Spring Boot framework is one of the most popular Java-based microservice frameworks that helps developers quickly and easily deploy Java applications. When the endpoint actuator is accessible with the env and restart methods, it is possible for an unauthenticated remote attacker to obtain a...

Spring Boot Actuator Sensitive Endpoints Detected

Spring Boot Actuator endpoints let you monitor and interact with your application. Spring Boot includes a number of built-in endpoints and lets you add your own. For example, the 'health' endpoint provides basic application health information. But some of these endpoints are considered sensitive...

Spring Boot Actuator Detected

This is an informational notice that the scanner was able to detect an accessible Spring Actuator. Actuator endpoints let you monitor and interact with your application. Spring Boot includes a number of built-in endpoints and lets you add your own. For example, the 'health' endpoint provides basi...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228 !Dockerfilehttps://github.com/ahmad4fifz/C...

org.camunda.bpm.extension.swagger.example:camunda-bpm-swagger-example-spring-boot (7.8.0), org.camunda.bpm.extension.swagger:swagger-ui (7.8.0) potentially affected by CVE-2018-25031 via org.webjars:swagger-ui (3.1.4)

org.webjars:swagger-ui MAVEN version 3.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - org.camunda.bpm.extension.swagger.example:camunda-bpm-swagger-example-spring-boot 7.8.0 -...

com.gitblit.fathom:fathom-integration-test (>=0.5.2, <=0.6.0), com.gitblit.fathom:fathom-rest-swagger (>=0.5.2, <=0.6.0) +1 more potentially affected by CVE-2018-25031 via org.webjars:swagger-ui (2.1.0)

org.webjars:swagger-ui MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.gitblit.fathom:fathom-integration-test =0.5.2, =0.5.2, =7.11.0.final, =7.34.0.final Source cves: CVE-2018-25031...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.0-rc1, <=0.2.1), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.0-rc1, <=0.2.1) +4 more potentially affected by CVE-2021-44667 via com.alibaba.nacos:nacos-common (0.2.1-rc1)

com.alibaba.nacos:nacos-common MAVEN version 0.2.1-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.0-rc1, =0.1.0-rc1, =0.1.0-rc1, =0.1.0-rc...

Keking kkFileview path traversal vulnerability

Keking KkFileview is a Spring-Boot project from Keking Technology Keking, a Chinese company that builds online previews for documents. A security vulnerability exists in Keking KkFileview, which originates from the presence of a directory traversal vulnerability to read arbitrary files, which cou...