org.springframework.integration:spring-integration-samples (1.0.2.sr1) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (1.0.2.sr1)

org.springframework.integration:spring-integration-ws MAVEN version 1.0.2.sr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: -...

com.github.ptomli.bedrock:bedrock-core (1.0.0) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (2.2.1.release)

org.springframework.integration:spring-integration-ws MAVEN version 2.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - com.github.ptomli.bedrock:bedrock-core 1.0.0...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (3.0.0.release)

org.springframework.integration:spring-integration-ws MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0.1...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.1.27-release) +20 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=4.2.0.release, <=4.3.17.release)

org.springframework.integration:spring-integration-ws MAVEN version =4.2.0.release, =1.0.110-release, =1.0.111-release, =1.0.111-release, =1.1.0-release, =1.0.111-release, =1.0.111-release, =1.0.0, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.4.0 and...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.1.27-release) +20 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=4.2.0.release, <=4.3.17.release)

org.springframework.integration:spring-integration-ws MAVEN version =4.2.0.release, =1.0.110-release, =1.0.111-release, =1.0.111-release, =1.1.0-release, =1.0.111-release, =1.0.111-release, =1.0.0, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.4.0 and...

cloud.altemista.fwk.integration:cloud-altemistafwk-core-integration-ws-conf (>=3.0.0.release, <=3.0.1.release), com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.2.6-release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=5.0.1.release, <=5.0.7.release)

org.springframework.integration:spring-integration-ws MAVEN version =5.0.1.release, =3.0.0.release, =2.0.0-rc1, =2.2.6-release Source cves: CVE-2019-3772 Source advisory: OSV:GHSA-WR5R-M8PC-85J9...

cloud.altemista.fwk.integration:cloud-altemistafwk-core-integration-ws-conf (>=3.0.0.release, <=3.0.1.release), com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.2.6-release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=5.0.1.release, <=5.0.7.release)

org.springframework.integration:spring-integration-ws MAVEN version =5.0.1.release, =3.0.0.release, =2.0.0-rc1, =2.2.6-release Source cves: CVE-2019-3772 Source advisory: GHSA-WR5R-M8PC-85J9...

GHSA-WR5R-M8PC-85J9 Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772 Spring Integration XML External Entity Injection (XXE)

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772: Improper Restriction of XML External Entity Reference

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

XML External Entity Injection (XXE)

Spring Integration is vulnerable to XML external entity injection XXE. The library does not filter malicious XML data input due to failing to disable the Document Type Definition External Entities by default...

PT-2019-1977

Name of the Vulnerable Software and Affected Versions Spring Integration versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions Description The issue is related to XML External Entity Injection XXE when receiving XML data from untrusted sources. This is due to incorrect restriction of XML...

XML External Entity Injection (XXE)

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Pivotal Spring Integration Zip Arbitrary File Write Vulnerability

Pivotal Spring Integration Zip is the United States Pivotal Software, Inc. of a compression/uncompression components used in Spring. An arbitrary file write vulnerability exists in Pivotal Spring Integration Zip. This allows an attacker to write arbitrary files to an affected system...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.springframework.integration:spring-integration-zip provides Zip un- compression support. Affected versions of the package are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". It is exploited using a specially crafted zip archive, that holds path traversal...

CVE-2018-1263

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

CVE-2018-1263

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...