br.com.anteros:anteros-keycloak (1.0.0), com.github.paulcwarren:content-rest-spring-boot-starter (>=v1.2.0, <=1.2.4) +33 more potentially affected by CVE-2021-22047 via org.springframework.data:spring-data-rest-core (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-rest-core MAVEN version =3.4.0, =v1.2.0, =v1.2.0, =v1.2.0, =1.5.0, =1.5.0, =1.5.0, =0.0.2.1, =0.2.2, =0.0.1, =0.2.5, =0.9.0, =0.9.1 and more Source cves: CVE-2021-22047 Source advisory: MEND:CVE-2021-22047...

be.personify.iam:personify-api (>=1.2.6.release, <=1.3.1.release), be.personify.iam:personify-frontend (>=1.2.6.release, <=1.3.0.release) +50 more potentially affected by CVE-2021-22047 via org.springframework.data:spring-data-rest-core (>=3.5.0, <=3.5.5)

org.springframework.data:spring-data-rest-core MAVEN version =3.5.0, =1.2.6.release, =1.2.6.release, =1.2.5.release, =2.1.0, =2.1.0, =2.1.0, =5.3.0, =2.1.0, =1.1.0, =2.5.0, =2.5.1 and more Source cves: CVE-2021-22047 Source advisory: MEND:CVE-2021-22047...

PT-2021-14846

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.4.0 through 3.4.13 Spring Data REST versions 3.5.0 through 3.5.5 Spring Data REST older unsupported versions Description The issue affects HTTP resources implemented by custom controllers using a configured base API...

CVE-2021-22047: Exposure of Sensitive Information to an Unauthorized Actor

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

VMware Spring Security security vulnerabilities

VMware Spring Security is a set of security frameworks from VMware that provide illustrative security protections for Spring-based applications. A security vulnerability exists in Spring Data REST that stems from the additional disclosure of HTTP resources under the uri for custom controller...

Potential Security Bypass for customized Spring Data REST Resource

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

Spring Data REST Installed

Binary data pivotalsoftwarespringdatarestinstalled.nbin...

VulnCheck KEV: CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

GHSA-4FQ3-MR56-CG6R Spring Data Commons remote code injection vulnerability

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

spring-boot: Malicious PATCH requests submitted to servers can use specially crafted JSON data to run arbitrary Java code

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

Pivotal Spring Data Commons / Spring Data REST XXE File Disclosure

XXE file disclosure in Pivotal Spring Data Commons / Spring Data REST Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

CVE-2018-1273

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

PT-2018-3847

Name of the Vulnerable Software and Affected Versions Spring Data Commons versions prior to 1.13.10 Spring Data Commons versions 2.0 to 2.0.5 Spring Data Commons older unsupported versions Description The issue is caused by improper neutralization of special elements, leading to a property binder...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution Ex

Exploit for java platform in category web applications // Exploit Title: RCE in PATCH requests in Spring Data REST // Date: 2018-03-10 // Exploit Author: Antonio Francesco Sardella // Vendor Homepage: https://pivotal.io/ // Software Link: https://projects.spring.io/spring-data-rest/ // Version:...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

// Exploit Title: RCE in PATCH requests in Spring Data REST // Date: 2018-03-10 // Exploit Author: Antonio Francesco Sardella // Vendor Homepage: https://pivotal.io/ // Software Link: https://projects.spring.io/spring-data-rest/ // Version: Spring Data REST versions prior to 2.6.9 Ingalls SR9,...

Spring Data REST PATCH Request Remote Code Execution

// Exploit Title: RCE in PATCH requests in Spring Data REST // Date: 2018-03-10 // Exploit Author: Antonio Francesco Sardella // Vendor Homepage: https://pivotal.io/ // Software Link: https://projects.spring.io/spring-data-rest/ // Version: Spring Data REST versions prior to 2.6.9 Ingalls SR9,...

Spring Data REST 2.6.9 (Ingalls SR9) 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 Ingalls SR9 3.0.1 Kay SR1 - PATCH Request Remote Code Execution // Exploit Title: RCE in PATCH requests in Spring Data REST // Date: 2018-03-10 // Exploit Author: Antonio Francesco Sardella // Vendor Homepage: https://pivotal.io/ // Software Link:...

Exploit for Improper Input Validation in Vmware Spring_Boot

Spring Break Vulnerable Application This is a vulnerable appl...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

Spring data rest 远程代码执行(cve-2017-8046)

漏洞描述 漏洞描述 Spring Data Rest 在处理 PATCH 请求时存在RCE高危漏洞, 可以使用手工构造的JSON数据构造恶意PATCH请求提交至spring-data-rest服务器，使得服务器运行恶意JAVA代码。Spring Data Rest项目的目标是提供一种灵活的、可配置的机制，编写出可以对外暴露出HTTP协议的简单服务。 Git地址: https://github.com/spring-projects/spring-data-rest 漏洞来源: https://pivotal.io/security/cve-2017-8046 影响版本： Spring...