cve-2017-4971

CVE-2017-4971 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2017-4971 Image author: https://github.com/Medicean/VulApps/tree/master/s/springwebflow/1...

Spring-Web-5xx-Mitigated-version

Spring-Web-5xx-Mitigated-version 概述 该 Spring Web（5.x.x）的缓解版本专门为应对多个供应商通过 Sonatype 和 Mend 检测到的严重漏洞而打造。这些漏洞依据 CVE-2016-1000027 公告进行标识，当使用 Spring Framework 4.1.4 对不受信任的数据进行 Java 反序列化时，存在远程代码执行（RCE）风险。需要特别指出，建议的解决方案是升级到 5.x.x 以上的版本，这要求使用 OpenJDK 17 或更高版本。然而，由于依赖 Sonatype 和 Mend 的各组织面临技术限制，通常需要继续使用...

spring-web-without-remoting

spring-web-without-remoting 移除了 org.springframework.remoting 包的 Spring Web 5.x，用于修复 CVE-2016-1000027。 更多信息，请参见 spring-projects/spring-framework 24434。...

cve-2022-22965

Minimal CVE-2022-22965 example At the time of writing, spring-web request params binding WebDataBinder, by default allows accessing object's getClass method. This is an internal jvm specific implementation detail imho shouldn't be exposed. As such, its features may change and be expanded with...

ROOT-APP-MAVEN-CVE-2024-38820 CVE-2024-38820 in org.springframework:spring-web - Patched by Root

Root has patched CVE-2024-38820 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22259 CVE-2024-22259 in org.springframework:spring-web - Patched by Root

Root has patched CVE-2024-22259 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22243 CVE-2024-22243 in org.springframework:spring-web - Patched by Root

Root has patched CVE-2024-22243 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22262 CVE-2024-22262 in org.springframework:spring-web - Patched by Root

Root has patched CVE-2024-22262 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22745 CVE-2026-22745 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-22745 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-41234 CVE-2025-41234 in org.springframework:spring-web - Patched by Root

Root has patched CVE-2025-41234 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38809 CVE-2024-38809 in org.springframework:spring-web - Patched by Root

Root has patched CVE-2024-38809 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...

CVE-2026-19651

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources. Mitigation...

HTTP Response Splitting

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to HTTP Response Splitting via the...

Cross-site Scripting (XSS)

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the...

Cross-Site Scripting (XSS)

Spring Web Flow is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the JavaScript RemotingHandler rendering error-response bodies as HTML even when the response is not text/html, which allows an attacker to exploit the issue by injecting malicious input that is reflected in...

ROOT-APP-MAVEN-CVE-2016-1000027 CVE-2016-1000027 in org.springframework:spring-web - Patched by Root

Root has patched CVE-2016-1000027 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...

Expression Language Injection

Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...

K000162893: Spring Web Services vulnerability CVE-2026-40995

Security Advisory Description X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks disabled, locked, expired, or credentials-expired accounts...

K000162436: Spring Web Flow vulnerability CVE-2026-40985

Security Advisory Description Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1. CVE-2026-40985 Impact There is no impact; F5 products are not...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway for Multiplatforms due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, Spring Beans and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring...