Unauthorized Access Vulnerability in Huaxia ERP

Huaxia ERP based on SpringBoot framework , aspires to provide small and medium-sized enterprises with open source and good ERP software , currently focusing on sales and inventory + financial functions . Huaxia ERP has an unauthorized access vulnerability that can be exploited by attackers to...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.6.SP2 security update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

SQL Injection Vulnerability in Mini-Tmall Framework Front and Backend

Mini Tmall Mini Tmall is a Spring Boot-based integrated B2C e-commerce platform, the requirements of the design of the main reference Tmall shopping process: users start from registration, to complete the login, browse the products, add a shopping cart, place an order, confirm receipt, evaluation...

Unauthorized Access Vulnerability in JeewxBoot of Beijing National Torch Information Technology Co.

JeewxBoot is a SpringBoot-based open source WeChat housekeeper system , using SpringBoot2.1.3 Mybatis + Velocity framework technology. Beijing State Torch Information Technology Co. JeewxBoot has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive informati...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (3.0.3-rc), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (3.0.3-rc) +270 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (9.0.0-m5)

org.apache.wicket:wicket-core MAVEN version 9.0.0-m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context 3.0.3-rc -...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.15 security and bug fix update

An update is now available for Red Hat support for Spring Boot. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22) potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version 10.0.0-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-websocket and may be impacted: - nz.net.osnz.composite:composite-spring-boot-tomcat 5.22 Source...

SpringBootVulExploit

This repository contains a collection of Spring Boot vulnerability exploitation tools and techniques. The tools are designed to exploit various vulnerabilities in Spring Boot applications, including remote code execution RCE, privilege escalation, and data exfiltration. The repository includes...

Engel & Völkers Technology GmbH: Information disclosure via Spring Boot Actuators on gonext-stage.engelvoelkers.com

Summary: The Spring Boot Actuators are exposing critical information on gonext-stage.engelvoelkers.com such as the last 100 HTTP requests made to the server including cookies, paths, etc and the environment configuration. The endpoints are the following: - /trace - /env - /mappings - /configprops...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-11996 Source advisory: MEND:CVE-2020-11996...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +31303 more potentially affected by CVE-2020-14060 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-14060 Source advisory:...

XSS Vulnerability in My-Blog-layui

My-Blog-layui by SpringBoot + Layui + Mybatis + Thymeleaf and other technologies to achieve the Java blog system . My-Blog-layui has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

GitHub Security Lab: CodeQL query to detect open Spring Boot actuator endpoints

This bug was reported directly to GitHub Security Lab...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.13 security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.6 security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Guardedbox - Online Client-Side Manager For Secure Storage And Secrets Sharing

GuardedBox is an open-source online client-side manager for secure storage and secrets sharing. It allows users to upload secrets to a centralized server and retrieve them at anytime and from anywhere. It also allows users to share their secrets with other users, individually or via groups. Secre...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-9484 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-9484 Source advisory: GHSA-344F-F5VG-2JFJ...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-9484 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-9484 Source advisory: OSV:GHSA-344F-F5VG-2JFJ...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-9484 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-9484 Source advisory: MEND:CVE-2020-9484...