Security Bulletin: A vulnerability in Spring Framework affects IBM Watson Machine Learning Accelerator

Summary A vulnerability exists in Spring Framework version used by IBM Watson Machine Learning Accelerator. Spring framework upgrade to version 5.2.15 which resolves these vulnerabilities, is available on IBM Fix Central. Vulnerability Details CVEID: CVE-2021-22118 DESCRIPTION: VMware Tanzu Sprin...

Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities

Summary IBM Data Risk Manager has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2021-20227 DESCRIPTION: SQLite is vulnerable to a denial of service, caused by a use-after-free flaw in the SELECT query function in src/select.c. By sending a specially-crafted request, a...

Demo: A Guide to Virtual Machine App Security

Enhance your virtual machine VM application security from vulnerabilities in your Spring Framework Java application by reviewing these guidelines...

Demo: A Guide to Virtual Machine App Security

Enhance your virtual machine VM application security from vulnerabilities in your Spring Framework Java application by reviewing these guidelines...

UReport 代码注入漏洞

UReport is a high-performance pure Java reporting engine based on the Spring architecture. The vulnerability stems from a lack of access control to the designer page. An attacker can exploit this vulnerability to execute arbitrary code...

Security Bulletin: IBM Security Guardium is affected by a Spring Framework vulnerability

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2020-5421 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation. By using a specially-crafted jsessionid path...

Security Bulletin: A Privilege Escalation vulnerability in Pivotal Spring Framework affects IBM LKS Administration & Reporting Tool and its Agent

Summary A Privilege Escalation related vulnerability has been found in Pivotal Spring Framework used by IBM LKS Administration & Reporting Tool ART and its Agent. A fix has been published. Vulnerability Details CVEID: CVE-2021-22118 DESCRIPTION: VMware Tanzu Spring Framework could allow a local...

springframework: RFD protection bypass via jsessionid

In Spring Framework, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

WS-2021-0173

In spring-framework, versions v3.0.0.M1 through v3.0.5.RELEASE are vulnerable to Cross-Site Scripting XSS, due to LocaleChangeInterceptor not escaping the Locale value from a user HTTP request...

WS-2021-0174

In spring-framework, versions 4.0.0 to 4.0.1 and 3.0.0 to 3.2.18, are vulnerable against CGLIB memory leak for method injection as a result of mishandled callbacks and non-static classes...

WS-2021-0172

In spring-framework, versions v5.0.0.M1 through v5.0.20.RELEASE are vulnerable to cross-site request forgery CSRF, due to ‘SameSite’ cookie not implemented...

The vulnerability of the Spring Framework software, caused by privilege management errors, allows a hacker to read and rewrite any files they desire.

The vulnerability of the Spring Framework software is caused by privilege management errors. Exploiting this vulnerability allows an attacker to read and rewrite any files at will...

CVE-2021-22118

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by recreating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFl...

CVE-2021-29500

bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs...

CVE-2021-29500

bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs...

Design/Logic Flaw

bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs...

CVE-2021-29500

bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs...

CVE-2021-29500

The CVE-2021-29500 issue affects the bubble-fireworks project (fxbin/bubble-fireworks) in BUILD-SNAPSHOT builds. The root cause is improper verification of JSON Web Token signatures in the library’s JWT handling, which enables forgery of valid JWTs. Affected component: bubble-fireworks-core/JWT v...

CVE-2021-29500 Missing validation of JWT signature

bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs...

PT-2021-18255

Name of the Vulnerable Software and Affected Versions: bubble fireworks versions prior to 2021.BUILD-SNAPSHOT Description: The issue concerns a vulnerability in the package where it did not properly verify the signature of JSON Web Tokens, allowing for the forgery of valid JWTs. This affects the...