org.springframework.data:spring-data-mongodb-cross-store (2.0.3.release), org.springframework.integration:spring-integration-mongodb (5.0.1.release) potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.0.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

org.springframework.data:spring-data-mongodb-cross-store (1.5.6.release), org.springframework.integration:spring-integration-mongodb (>=4.0.8.release, <=4.0.9.release) potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.5.6.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.antelopesystem.crudframework:crud-framework-mongo-connector (>=0.1.0, <=0.5.0), com.antelopesystem.crudframework:crud-framework-utils (>=0.1.1, <=0.5.0) +4 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.0.13.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.0.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.antelopesystem.crudframework:crud-framework-mongo-connecto...

de.bwaldvogel:mongo-java-server-test-common (1.34.0), io.holunda.taskpool:camunda-bpm-taskpool-view-mongo (>=2.0.7, <=2.1.2) +4 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.2.9.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - de.bwaldvogel:mongo-java-server-test-common 1.34.0 -...

capital.scalable:spring-auto-restdocs-core (>=2.0.7, <=2.0.11), com.epages:restdocs-api-spec (>=0.11.2, <=0.16.4) +26 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.0.15.release)

org.springframework:spring-web MAVEN version 5.0.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - capital.scalable:spring-auto-restdocs-core =2.0.7, =0.11.2, =0.11.2, =0.11.2, =0.11.2,...

com.microsoft.aad:adal4j (0.0.1), com.nimbusds:oauth2-oidc-sdk (>=2.14.2, <=3.0) +7 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (2.22.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.microsoft.aad:adal4j 0.0.1 - com.nimbusds:oauth2-oidc-sdk =2.14.2, =1.2, =1.2, =1.24.0, =1.1.1,...

spring-integration-zip Arbitrary File Write

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

de.mhus.app.vault:vault-playground-assembly (>=7.2.0, <=7.3.0), de.mhus.cherry.vault:vault-playground-assembly (7.1.0) +45 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.26.release)

org.springframework:spring-messaging MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - de.mhus.app.vault:vault-playground-assembly =7.2.0, =7.1.0, =7.1.0, =7.1.0,...

org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms (4.2.9.release_1), org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-ws-support (>=2.4.2.release_1, <=2.4.2.release_2) +36 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.2.9.release)

org.springframework:spring-messaging MAVEN version 4.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms...

io.oasp.java.modules:oasp4j-batch (>=1.5.0, <=2.6.1), org.springframework.batch:spring-batch-integration (>=3.0.0.release, <=3.0.8.release) +29 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.5.release)

org.springframework:spring-messaging MAVEN version 4.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - io.oasp.java.modules:oasp4j-batch =1.5.0, =3.0.0.release, =1.1.0.release,...

org.springframework.batch:spring-batch-integration (3.0.9.release), org.springframework.boot:spring-boot-starter-integration (>=1.1.11.release, <=1.1.12.release) +27 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.9.release)

org.springframework:spring-messaging MAVEN version 4.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.springframework.batch:spring-batch-integration 3.0.9.release -...

org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms (4.3.28.release_1), org.springframework.integration:spring-integration-amqp (4.3.23.release) +32 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.28.release)

org.springframework:spring-messaging MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms...

Path Traversal in Spring-integration-zip

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

com.farao-community.farao:gridcapa-data-bridge (>=1.0.0, <=1.3.2), com.pleosoft.pleodox:pleodox-core (>=1.0.0-release, <=1.0.2-release) potentially affected by CVE-2021-22114 via org.springframework.integration:spring-integration-zip (>=1.0.2.release, <=1.0.3.release)

org.springframework.integration:spring-integration-zip MAVEN version =1.0.2.release, =1.0.0, =1.0.0-release, =1.0.2-release Source cves: CVE-2021-22114 Source advisory: OSV:GHSA-VW83-H3MQ-3QWJ...

com.farao-community.farao:gridcapa-data-bridge (>=1.0.0, <=1.3.2), com.pleosoft.pleodox:pleodox-core (>=1.0.0-release, <=1.0.2-release) potentially affected by CVE-2021-22114 via org.springframework.integration:spring-integration-zip (>=1.0.2.release, <=1.0.3.release)

org.springframework.integration:spring-integration-zip MAVEN version =1.0.2.release, =1.0.0, =1.0.0-release, =1.0.2-release Source cves: CVE-2021-22114 Source advisory: GHSA-VW83-H3MQ-3QWJ...

GHSA-VW83-H3MQ-3QWJ Path Traversal in Spring-integration-zip

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

io.kubernetes:client-java-examples (9.0.1), io.kubernetes:client-java-extended (9.0.1) +1 more potentially affected by CVE-2021-25738 via io.kubernetes:client-java (9.0.1)

io.kubernetes:client-java MAVEN version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.kubernetes:client-java and may be impacted: - io.kubernetes:client-java-examples 9.0.1 - io.kubernetes:client-java-extended 9.0.1 -...

io.kubernetes:client-java-examples (9.0.3), io.kubernetes:client-java-extended (9.0.3) +1 more potentially affected by CVE-2021-25738 via io.kubernetes:client-java (9.0.3)

io.kubernetes:client-java MAVEN version 9.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.kubernetes:client-java and may be impacted: - io.kubernetes:client-java-examples 9.0.3 - io.kubernetes:client-java-extended 9.0.3 -...

Exploit for Improper Authentication in Apache Shiro

Apache Shiro 两种姿势绕过认证分析（CVE-2020-17523） 0x01 漏洞描述 Apache Shiro是一个强大且易用的Java安全框架，执行身份验证、授权、密码和会话管理。使用Shiro的易于理解的API，您可以快速、轻松地获得任何应用程序，从最小的移动应用程序到最大的网络和企业应用程序。 当它和 Spring 结合使用时，在一定权限匹配规则下，攻击者可通过构造特殊的 HTTP 请求包完成身份认证绕过。 影响范围：Apache Shiro / | | 双反斜杠处理成反斜杠 | // - / | | 以/.或者/..结尾，则在结尾添加/ | /. - /./ /.....

Arbitrary File Rewrite

spring-integration-zip is vulnerable to an arbitrary file rewrite aka a zip slip vulnerability. An incomplete fix of CVE-2018-1263 allows an attacker to send a malicious zip archive bzip2, tar, xz, war, cpio, 7z with path traversal filenames, leading to writing of files outside of the target...