cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +171 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.0.2.release)

org.springframework:spring-expression MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...

br.com.thiagomoreira.replicon:replicon4j (>=0.1, <=1.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (0.6) +469 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.0.6.release)

org.springframework:spring-expression MAVEN version 4.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.thiagomoreira.replicon:replicon4j =0.1, =3.0.3, =3.0.3, =3.0.3, =3.0.5...

cn.bridgeli:master-slave-db-selector (>=0.0.1, <=0.0.2), com.avanza.astrix:astrix-spring (>=0.38.1, <=0.43.6) +195 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.1.1.release)

org.springframework:spring-expression MAVEN version 4.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.bridgeli:master-slave-db-selector =0.0.1, =0.38.1, =0.14.0, =0.14.0,...

ch.ralscha:extdirectspring (1.5.0), cn.enilu:flash-core (1.0) +136 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.1.2.release)

org.springframework:spring-expression MAVEN version 4.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.ralscha:extdirectspring 1.5.0 - cn.enilu:flash-core 1.0 -...

br.com.neppo.jlibs:jira-client (1.0), cn.chenzw.swagger:swagger-ext-all (1.0.1) +486 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.24.release)

org.springframework:spring-expression MAVEN version 4.3.24.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.neppo.jlibs:jira-client 1.0 - cn.chenzw.swagger:swagger-ext-all 1.0.1...

ch.rasc:sse-eventbus (1.1.9), com.atlassian.oai:swagger-request-validator-examples (>=2.9.1, <=2.13.0) +479 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.26.release)

org.springframework:spring-expression MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.rasc:sse-eventbus 1.1.9 -...

com.github.dalet-oss:mongobee (>=1.0.1, <=1.0.4), com.github.mjeanroy:springmvc-mustache (>=0.6.0, <=1.0.0) +146 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.27.release)

org.springframework:spring-expression MAVEN version 4.3.27.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.dalet-oss:mongobee =1.0.1, =0.6.0, =0.10.0, =0.10.0, =0.10.0,...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

cn.deepbit:deepbit-sdk (8.3.7), cn.deepbit:deepbit-start-mvc (8.3.7) +501 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.23.release)

org.springframework:spring-expression MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.deepbit:deepbit-sdk 8.3.7 - cn.deepbit:deepbit-start-mvc 8.3.7 -...

be.personify.iam:personify-api (>=1.0.2.release, <=1.0.8.release), club.trandiscuss:api-doc-gen (0.1) +807 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.25.release)

org.springframework:spring-expression MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.personify.iam:personify-api =1.0.2.release, =2.2.1zzlh, =2.2.1zzlh, =1.4....

com.github.skeychen:dswork-common-ssosdk (>=9.0.1, <=9.1.1), com.github.skeychen:dswork-config (>=9.0.1, <=9.1.1) +127 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.28.release)

org.springframework:spring-expression MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.skeychen:dswork-common-ssosdk =9.0.1, =9.0.1, =9.0.1, =9.0.1,...

cn.zzq0324:feature-flag (>=1.0.1, <=1.0.2), com.51degrees:device-detection (>=4.4.1, <=4.4.2) +552 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.30.release)

org.springframework:spring-expression MAVEN version 4.3.30.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.zzq0324:feature-flag =1.0.1, =4.4.1, =4.3.10, =4.3.10, =4.3.14, =4.3.14,...

GHSA-9CMQ-M9J5-MVWW Spring Framework vulnerable to Denial of Service

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language SpEL expression that may cause a denial of service DoS condition. Older, unsupported versions are also affected. Specifically, an...

UBUNTU-CVE-2024-38808

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language SpEL expression that may cause a denial of service DoS condition. Specifically, an application is vulnerable when the following is true:...

CVE-2024-38808 CVE-2024-38808: Spring Expression DoS Vulnerability

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language SpEL expression that may cause a denial of service DoS condition. Specifically, an application is vulnerable when the following is true:...

Spring Framework security vulnerabilities

VMware Spring Framework is a set of open source Java, JavaEE application frameworks from VMware. The framework helps developers build high-quality applications. A security vulnerability exists in Spring Framework versions 5.3.0 through 5.3.38, which stems from the possibility that a user may supp...

OSV-2024-1018 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67071 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.util.ConcurrentReferenceHashMap$Segment.restructureIfNecessa...

OSV-2024-930 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70893 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/sun.reflect.generics.reflectiveObjects.ParameterizedTypeImpl.hashCode...

VMware Spring Framework < 5.3.39 Spring Expression DoS Vulnerability - Linux

The VMware Spring Framework is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

VMware Spring Framework < 5.3.39 Spring Expression DoS Vulnerability - Windows

The VMware Spring Framework is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...