nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-11996 Source advisory: OSV:GHSA-53HP-JPWQ-2JGQ...

cn.iisme.cloud:iisme-demos-shiro-web (1.0.1), cn.iisme.cloud:iisme-starter-shiro (1.0.1) +69 more potentially affected by CVE-2020-17523 via org.apache.shiro:shiro-spring-boot-starter (>=1.4.0-rc2, <=1.7.0)

org.apache.shiro:shiro-spring-boot-starter MAVEN version =1.4.0-rc2, =1.1.1, =0.0.6, =0.0.6, =2.1.1, =2.0.4-rc1, =2.2.0, =2.2.0, =1.0.0, =1.0.1 and more Source cves: CVE-2020-17523 Source advisory: OSV:GHSA-V98J-7CRC-WVRJ...

cn.iisme.cloud:iisme-demos-shiro-web (1.0.1), cn.iisme.cloud:iisme-starter-shiro (1.0.1) +69 more potentially affected by CVE-2020-17523 via org.apache.shiro:shiro-spring-boot-starter (>=1.4.0-rc2, <=1.7.0)

org.apache.shiro:shiro-spring-boot-starter MAVEN version =1.4.0-rc2, =1.1.1, =0.0.6, =0.0.6, =2.1.1, =2.0.4-rc1, =2.2.0, =2.2.0, =1.0.0, =1.0.1 and more Source cves: CVE-2020-17523 Source advisory: GHSA-V98J-7CRC-WVRJ...

io.undertow:undertow-servlet (1.3.28.final), io.undertow:undertow-websockets-jsr (1.3.28.final) +1 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.3.28.final)

io.undertow:undertow-core MAVEN version 1.3.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.28.final - io.undertow:undertow-websockets-jsr 1.3.28.final -...

de.adorsys.oauth:oauth-wildfly-support (>=0.12, <=0.35), io.undertow:undertow-servlet (1.1.8.final) +4 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.1.8.final)

io.undertow:undertow-core MAVEN version 1.1.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.adorsys.oauth:oauth-wildfly-support =0.12, =7.12.0, =1.2.6.release, =1.2.7.release -...

com.github.dkubiak:goldfish-collector-maven (1.0), com.github.dkubiak:goldfish-server (1.0) +3 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.1.4.final)

io.undertow:undertow-core MAVEN version 1.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.dkubiak:goldfish-collector-maven 1.0 - com.github.dkubiak:goldfish-server 1.0 -...

io.undertow:undertow-servlet (1.1.7.final), io.undertow:undertow-websockets-jsr (1.1.7.final) +1 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.1.7.final)

io.undertow:undertow-core MAVEN version 1.1.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.7.final - io.undertow:undertow-websockets-jsr 1.1.7.final -...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22) potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version 10.0.0-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-websocket and may be impacted: - nz.net.osnz.composite:composite-spring-boot-tomcat 5.22 Source...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22) potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version 10.0.0-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-websocket and may be impacted: - nz.net.osnz.composite:composite-spring-boot-tomcat 5.22 Source...

com.gitee.pulanos.pangu:pangu-gateway-spring-boot-starter (>=5.0.7, <=5.1.0), org.apache.shenyu:shenyu-admin (>=2.4.0, <=2.4.1) +108 more potentially affected by CVE-2021-45029 via org.apache.shenyu:shenyu-common (>=2.4.0, <=2.4.1)

org.apache.shenyu:shenyu-common MAVEN version =2.4.0, =5.0.7, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.1 and more Source cves: CVE-2021-45029 Source advisory: OSV:GHSA-GH38-X2WM-XMC8...

JavaQuarkBBS Cross-Site Scripting Vulnerability

JavaQuarkBbs is a simple Java community based on Spring Boot implementation in China.JavaQuarkBBS in v2 and its previous versions suffers from a cross-site scripting vulnerability, which stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit thi...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4j Spring vulnerable POC This is a POC for a simple spring...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4shell-rmi-poc A Proof of Concept of the Log4j vulnerabilit...

Metasploit Wrap-Up

Log4Shell - Log4j HTTP Scanner Versions of Apache Log4j impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will scan an HTTP endpoint for the...

IBM Spectrum Copy Data Management Unauthorized Access Vulnerability

IBM Spectrum Copy Data Management, an IBM company that modernizes, streamlines, and automates data center copy management processes, has a security vulnerability that could be exploited by an attacker to gain unauthorized access to the Spring Boot console...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Simple Spring Boot application vulnerable to CVE-2021-44228 L...

CVE-2021-39052

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. IBM X-Force ID: 214523...

CVE-2021-39052

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. IBM X-Force ID: 214523...

Authorization

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. IBM X-Force ID: 214523...

CVE-2021-39052

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. IBM X-Force ID: 214523...