cve-2022-42889-text4shell

Install maven - maven-linux 1. Maven install to create the fat jar mvn clean install 2. Docker build docker build --tag=text4shell . 3. Docker run docker run -p 80:8080 text4shell 4. Test the app http://localhost/text4shell/attack?search= 5. Attack can be performed by passing a string...

CVE-2026-22738

CVE-2026-22738 Reproduction Environment Vulnerability Description CVE-2026-22738 is a SpEL Spring Expression Language injection vulnerability in Spring AI SimpleVectorStore that can lead to unauthenticated remote code execution RCE. Affected Versions Artifact| Affected Versions| Fixed Versions...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 demo test please UPGRADE spring data rest NOW. steps 启动本应用 创建test instance POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" 利用spel注入, 会启动C:\Windows\system32\calc.exe PATCH /entityPersons/1...

ROOT-APP-MAVEN-CVE-2026-41849 CVE-2026-41849 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2026-41849 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-20863 CVE-2023-20863 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2023-20863 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38808 CVE-2024-38808 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2024-38808 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-20861 CVE-2023-20861 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2023-20861 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41850 CVE-2026-41850 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2026-41850 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas. Vulnerabilities include resource exhaustion and...

Security Bulletin: Spring Framework (spring-expression) — Denial of Service via SpEL Power Operator

Summary spring-expression-6.2.19.jar detected by Mend scanner in db2-service-java/pom.xml. The affected version 6.2.19 is vulnerable to CVE-2026-47886 where applications evaluating user-supplied Spring Expression Language SpEL expressions using the power operator ^ with a BigDecimal or BigInteger...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in Spring Expression (CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 )

Summary IBM Db2 Developer Extension is affected by vulnerability in Spring Expression CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

UBUNTU-CVE-2026-59283

Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring...

EUVD-2026-66854

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2026-41849

CVE-2026-41849...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the evaluation of user-supplied SpEL expressions containing the power operator ^ with a BigDecimal or BigInteger operand and a large exponent value. An attacker can cause excessive...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SimpleEvaluationContext file when the SpEL expression compiler is enabled through specific configuration settings. An attacker can cause unbounded class-loading growth and bypa...

Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance

Summary The spring package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-41850, CVE-2026-41851, CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL...

DoS (Denial of Service) org.springframework:spring-expression Dependency in Bamboo Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses...

DoS (Denial of Service) org.springframework:spring-expression Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker t...