com.evasion:client (>=1.0.0.1, <=1.0.0.3), org.grails:grails-webflow (>=2.2.0.rc1, <=2.2.5) +12 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.5.6.sec01)

org.springframework:spring-web MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.evasion:client =1.0.0.1, =2.2.0.rc1, =2.0.2, =1.0.0.release, =2.0.8.release,...

com.sun.jersey:jersey-spring (0.8-ea), org.springframework.ws:spring-ws-core (1.5.0) +5 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.5.2)

org.springframework:spring-web MAVEN version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.sun.jersey:jersey-spring 0.8-ea - org.springframework.ws:spring-ws-core 1.5.0 -...

com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (>=2.1.0, <=2.3.0), com.github.downgoon:jresty-rest (0.0.1) +802 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.5.6)

org.springframework:spring-web MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.amashchenko.struts2.actionflow:struts2-actionflow-showcase =2.1.0, =1.0.1, =0.1.0, =0.1.4,...

org.apache.struts:struts2-portlet (>=2.1.2, <=2.1.6), org.apache.struts:struts2-showcase (>=2.1.2, <=2.1.6) +18 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.5.3)

org.springframework:spring-web MAVEN version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.apache.struts:struts2-portlet =2.1.2, =2.1.2, =2.1.2, =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.0.1,...

com.bekk.boss:maven-jetty-pluto-embedded (1.0.1), de.eonas.portal:opencmsportal (>=8.5.1.1, <=10.5.1.9) +32 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.0.2)

org.springframework:spring-web MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.bekk.boss:maven-jetty-pluto-embedded 1.0.1 - de.eonas.portal:opencmsportal =8.5.1.1, =8.5.1.1,...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +13 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.0-m2)

org.springframework:spring-web MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0-rc2, =1.0.0 - org.apache.pluto:pluto-portal...

org.geoserver:community (1.4.0_gt2.2.x), org.geoserver:platform (>=1.4.0-m1, <=1.4.0_gt2.2.x) +7 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (1.2.5)

org.springframework:spring-web MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.geoserver:community 1.4.0gt2.2.x - org.geoserver:platform =1.4.0-m1, =1.4.0gt2.2.x -...

org.acegisecurity:acegi-security (1.0.4), org.acegisecurity:acegi-security-adapters (1.0.4) +14 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.0.4)

org.springframework:spring-web MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security 1.0.4 - org.acegisecurity:acegi-security-adapters 1.0.4 -...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

org.springframework:spring-hibernate (1.2.4), org.springframework:spring-mock (1.2.4) +3 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (1.2.4)

org.springframework:spring-web MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.4 - org.springframework:spring-mock 1.2.4 -...

com.discursive.taglib.reference:reference-taglib (1.0.1), com.exadel.flamingo.maven.plugin:flamingoapp (>=1.0.0, <=1.5.0) +22 more potentially affected by CVE-2013-6430 via org.springframework:spring-web (1.2.7)

org.springframework:spring-web MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.discursive.taglib.reference:reference-taglib 1.0.1 - com.exadel.flamingo.maven.plugin:flamingoa...

GHSA-36P3-WJMG-H94X Remote Code Execution in Spring Framework

Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as Spring4Shell. Impact A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the...

Critical: Red Hat Security Advisory: Red Hat Fuse 7.10.0 release and security update

A minor version update from 7.9 to 7.10 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel-K 1.6 release and security update

A minor version update from 1.4.2 to 1.6 is now available for Red Hat Integration Camel K that includes bug fixes and enhancements. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a...

spring-web: (re)creating the temporary storage directory could result in a privilege escalation within WebFlux application

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by recreating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFl...

Privilege Escalation

spring-web is vulnerable to privilege escalation. Creating or recreating the temporary storage directory creates multiple instances collision which allows a locally authenticated malicious user to read or modify files being uploaded or overwrite arbitrary files with multipart request data...

Update Atlassian Platform to 3.5.19 to fix CVE-2018-1000613, CVE-2019-17571 and other vulnerabilities

Update Atlassian Platform from 3.5.17 to 3.5.19. The new platform version brings changes in the following libraries: update com.atlassian.applinks: from 5.4.21 to 5.4.23 update com.atlassian.plugins: from 4.4.10 to 4.4.14 update com.atlassian.sal: from 3.1.2 to 3.1.3 update com.atlassian.streams:...

Update Atlassian Platform to 3.5.19 to fix CVE-2018-1000613, CVE-2019-17571 and other vulnerabilities

Update Atlassian Platform from 3.5.17 to 3.5.19. The new platform version brings changes in the following libraries: update com.atlassian.applinks: from 5.4.21 to 5.4.23 update com.atlassian.plugins: from 4.4.10 to 4.4.14 update com.atlassian.sal: from 3.1.2 to 3.1.3 update com.atlassian.streams:...

spring-ws: XML External Entity Injection (XXE) when receiving XML data from untrusted sources

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Reflected File Download (RFD) Attack

spring-web is vulnerable to Reflected File Download RFD attack. An incomplete fix of CVE-2015-5211 allows an attacker to bypass the protection against RFD attack via the jsessionid path parameter...