Exploit for Code Injection in Pivotal_Software Spring_Data_Commons

CVE-2018-1273 Spring Data Commons RCE 远程命令执行漏洞 usage !...

Information Disclosure

spring-data-jpa is vulnerable to information disclosure. Derived queries using any of the predicates startingWith, endingWith or containing could return more results than anticipated when a maliciously crafted query parameter value is supplied. LIKE expressions in manually defined queries could...

CVE-2019-3797

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE...

Additional information exposure with Spring Data JPA derived queries

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE...

VulnCheck KEV: CVE-2018-1273

Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution...

spring-data-commons: XXE with Spring Data’s XMLBeam integration

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict extern...

Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user or attacker can issue requests against Spring Data REST endpoints or endpoint...

am.ik.blog:blog-mapper (4.6.0), cc.javaone.jpa:jpa-common (1.0.0.release) +215 more potentially affected by CVE-2018-1274 via org.springframework.data:spring-data-commons (>=2.0.0.release, <=2.0.5.release)

org.springframework.data:spring-data-commons MAVEN version =2.0.0.release, =0.9.1-rc1, =0.0.2.release, =1.0.3, =1.2.1, =1.2.0, =2.0.1, =1.3.0, =2.0.0, =2.1.3 and more Source cves: CVE-2018-1274 Source advisory: GHSA-5Q8M-MQMX-PXP9...

am.ik.blog:blog-mapper (4.6.0), cc.javaone.jpa:jpa-common (1.0.0.release) +215 more potentially affected by CVE-2018-1274 via org.springframework.data:spring-data-commons (>=2.0.0.release, <=2.0.5.release)

org.springframework.data:spring-data-commons MAVEN version =2.0.0.release, =0.9.1-rc1, =0.0.2.release, =1.0.3, =1.2.1, =1.2.0, =2.0.1, =1.3.0, =2.0.0, =2.1.3 and more Source cves: CVE-2018-1274 Source advisory: OSV:GHSA-5Q8M-MQMX-PXP9...

GHSA-5Q8M-MQMX-PXP9 Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user or attacker can issue requests against Spring Data REST endpoints or endpoint...

am.ik.blog:blog-mapper (>=4.0.0, <=4.5.0), am.ik.home:uaa-client (>=1.0.0, <=1.9.0) +2430 more potentially affected by CVE-2018-1274 via org.springframework.data:spring-data-commons (>=1.5.0.release, <=1.13.10.release)

org.springframework.data:spring-data-commons MAVEN version =1.5.0.release, =4.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2, =0.2, =0.2, =0.2, =0.3 and more Source cves: CVE-2018-1274 Source advisory: OSV:GHSA-5Q8M-MQMX-PXP9...

am.ik.blog:blog-mapper (>=4.0.0, <=4.5.0), am.ik.home:uaa-client (>=1.0.0, <=1.9.0) +2430 more potentially affected by CVE-2018-1274 via org.springframework.data:spring-data-commons (>=1.5.0.release, <=1.13.10.release)

org.springframework.data:spring-data-commons MAVEN version =1.5.0.release, =4.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2, =0.2, =0.2, =0.2, =0.3 and more Source cves: CVE-2018-1274 Source advisory: GHSA-5Q8M-MQMX-PXP9...

am.ik.blog:blog-mapper (4.6.0), cc.javaone.jpa:jpa-common (1.0.0.release) +326 more potentially affected by CVE-2018-1259 via org.springframework.data:spring-data-commons (>=2.0.0.release, <=2.0.6.release)

org.springframework.data:spring-data-commons MAVEN version =2.0.0.release, =0.9.1-rc1, =1.1.4, =1.4.1, =0.0.2.release, =1.0.0, =1.0.3, =1.2.1, =1.2.4 - cn.xphsc.boot:jpamapper-spring-boot-stater 1.2.0 and more Source cves: CVE-2018-1259 Source advisory: OSV:GHSA-M929-7FR6-CVJG...

Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict extern...

am.ik.blog:blog-mapper (4.6.0), cc.javaone.jpa:jpa-common (1.0.0.release) +326 more potentially affected by CVE-2018-1259 via org.springframework.data:spring-data-commons (>=2.0.0.release, <=2.0.6.release)

org.springframework.data:spring-data-commons MAVEN version =2.0.0.release, =0.9.1-rc1, =1.1.4, =1.4.1, =0.0.2.release, =1.0.0, =1.0.3, =1.2.1, =1.2.4 - cn.xphsc.boot:jpamapper-spring-boot-stater 1.2.0 and more Source cves: CVE-2018-1259 Source advisory: GHSA-M929-7FR6-CVJG...

GHSA-M929-7FR6-CVJG Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict extern...

am.ik.blog:blog-mapper (>=4.0.0, <=4.5.0), am.ik.home:uaa-client (>=1.3.0, <=1.9.0) +1225 more potentially affected by CVE-2018-1273 via org.springframework.data:spring-data-commons (>=1.13.0.release, <=1.13.10.release)

org.springframework.data:spring-data-commons MAVEN version =1.13.0.release, =4.0.0, =1.3.0, =1.3.0, =1.3.0, =0.2, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-node 0.3 and more Source cves: CVE-2018-1273 Source advisory: OSV:GHSA-4FQ3-MR56-CG6R...

am.ik.blog:blog-mapper (>=4.0.0, <=4.5.0), am.ik.home:uaa-client (>=1.3.0, <=1.9.0) +1225 more potentially affected by CVE-2018-1273 via org.springframework.data:spring-data-commons (>=1.13.0.release, <=1.13.10.release)

org.springframework.data:spring-data-commons MAVEN version =1.13.0.release, =4.0.0, =1.3.0, =1.3.0, =1.3.0, =0.2, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-node 0.3 and more Source cves: CVE-2018-1273 Source advisory: GHSA-4FQ3-MR56-CG6R...

am.ik.blog:blog-mapper (4.6.0), cc.javaone.jpa:jpa-common (1.0.0.release) +215 more potentially affected by CVE-2018-1273 via org.springframework.data:spring-data-commons (>=2.0.0.release, <=2.0.5.release)

org.springframework.data:spring-data-commons MAVEN version =2.0.0.release, =0.9.1-rc1, =0.0.2.release, =1.0.3, =1.2.1, =1.2.0, =2.0.1, =1.3.0, =2.0.0, =2.1.3 and more Source cves: CVE-2018-1273 Source advisory: GHSA-4FQ3-MR56-CG6R...

am.ik.blog:blog-mapper (4.6.0), cc.javaone.jpa:jpa-common (1.0.0.release) +215 more potentially affected by CVE-2018-1273 via org.springframework.data:spring-data-commons (>=2.0.0.release, <=2.0.5.release)

org.springframework.data:spring-data-commons MAVEN version =2.0.0.release, =0.9.1-rc1, =0.0.2.release, =1.0.3, =1.2.1, =1.2.0, =2.0.1, =1.3.0, =2.0.0, =2.1.3 and more Source cves: CVE-2018-1273 Source advisory: OSV:GHSA-4FQ3-MR56-CG6R...