com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.1.6-release), org.springframework.cloud.stream.app:aggregate-counter-app-starters-build (>=2.0.0.release, <=2.0.2.release) +294 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=5.0.1.release, <=5.0.9.release)

org.springframework.integration:spring-integration-xml MAVEN version =5.0.1.release, =2.0.0-rc1, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.1.27-release) +396 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=4.1.5.release, <=4.3.17.release)

org.springframework.integration:spring-integration-xml MAVEN version =4.1.5.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.1.0-release, =1.0.83-rc1, =1.0.83-rc1, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.2.0, =2.4.0 and more Source cves:...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (3.0.0.release)

org.springframework.integration:spring-integration-ws MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0.1...

com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.1.6-release), org.springframework.cloud.stream.app:aggregate-counter-app-starters-build (>=2.0.0.release, <=2.0.2.release) +294 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=5.0.1.release, <=5.0.9.release)

org.springframework.integration:spring-integration-xml MAVEN version =5.0.1.release, =2.0.0-rc1, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2...

org.springframework.integration:spring-integration-samples (1.0.2.sr1) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (1.0.2.sr1)

org.springframework.integration:spring-integration-ws MAVEN version 1.0.2.sr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: -...

cloud.altemista.fwk.integration:cloud-altemistafwk-core-integration-ws-conf (>=3.0.0.release, <=3.0.1.release), com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.2.6-release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=5.0.1.release, <=5.0.7.release)

org.springframework.integration:spring-integration-ws MAVEN version =5.0.1.release, =3.0.0.release, =2.0.0-rc1, =2.2.6-release Source cves: CVE-2019-3772 Source advisory: GHSA-WR5R-M8PC-85J9...

GHSA-WR5R-M8PC-85J9 Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

org.springframework.integration:spring-integration-samples (1.0.2.sr1) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.2.sr1)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.2.sr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.1.27-release) +20 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=4.2.0.release, <=4.3.17.release)

org.springframework.integration:spring-integration-ws MAVEN version =4.2.0.release, =1.0.110-release, =1.0.111-release, =1.0.111-release, =1.1.0-release, =1.0.111-release, =1.0.111-release, =1.0.0, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.4.0 and...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.1.27-release) +20 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=4.2.0.release, <=4.3.17.release)

org.springframework.integration:spring-integration-ws MAVEN version =4.2.0.release, =1.0.110-release, =1.0.111-release, =1.0.111-release, =1.1.0-release, =1.0.111-release, =1.0.111-release, =1.0.0, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.4.0 and...

com.github.ptomli.bedrock:bedrock-core (1.0.0) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (2.2.1.release)

org.springframework.integration:spring-integration-ws MAVEN version 2.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - com.github.ptomli.bedrock:bedrock-core 1.0.0...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772 Spring Integration XML External Entity Injection (XXE)

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772: Improper Restriction of XML External Entity Reference

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

XML External Entity Injection (XXE)

Spring Integration is vulnerable to XML external entity injection XXE. The library does not filter malicious XML data input due to failing to disable the Document Type Definition External Entities by default...

PT-2019-1977

Name of the Vulnerable Software and Affected Versions Spring Integration versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions Description The issue is related to XML External Entity Injection XXE when receiving XML data from untrusted sources. This is due to incorrect restriction of XML...

XML External Entity Injection (XXE)

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Pivotal Spring Integration Zip Arbitrary File Write Vulnerability

Pivotal Spring Integration Zip is the United States Pivotal Software, Inc. of a compression/uncompression components used in Spring. An arbitrary file write vulnerability exists in Pivotal Spring Integration Zip. This allows an attacker to write arbitrary files to an affected system...