CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

Path traversal

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

CVE-2021-22114 concerns a path-traversal vulnerability in Spring Integration Zip handling. Connected sources indicate that Spring-integration-zip versions prior to 1.0.4 expose an arbitrary file write vulnerability via specially crafted zip archives (also affecting other archive formats like tar,...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

PT-2021-14856

Name of the Vulnerable Software and Affected Versions Spring-integration-zip versions prior to 1.0.4 Description The issue allows for an arbitrary file write, which can be achieved by using a specially crafted zip archive, as well as other archives such as bzip2, tar, xz, war, cpio, and 7z. These...

CVE-2021-22114: Improper Limitation of a Pathname to a Restricted Directory

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

Spring-integration-zip: Path traversal vulnerability

Spring Spring-integration-zip is Spring an open source application . Provides compression and decompression functionality A path traversal vulnerability exists in Spring-integration-zip versions prior to 1.0.4, which stems from an arbitrary file write vulnerability...

Zip-slip mitigation bypass in Spring Integration Zip extension

spring-integration-zip , versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So when the filename gets concatenated to...

CVE-2020-17510

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...

Kryo Codec Code Execution

The vulnerability of the Kryo Codec component in the software platform for integrating corporate applications in Spring Integration is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Pivotal Software Spring Integration Code Issue Vulnerability

Pivotal Software Spring Integration is an enterprise integration pattern from Pivotal Software, USA. The product is designed to enable lightweight messaging in Spring-based applications and supports integration with tail systems via declarative adapters. A code issue vulnerability exists in Pivot...

cn.strongculture:prometheus-spring-boot-starter (1.0.0), com.buession.springcloud:buession-springcloud-stream (1.2.0) +90 more potentially affected by CVE-2020-5413 via org.springframework.integration:spring-integration-core (>=5.3.0.release, <=5.3.1.release)

org.springframework.integration:spring-integration-core MAVEN version =5.3.0.release, =2.3.0.5, =2.3.0, =2.3.0, =1.0.4, =1.0.10, =1.0.4, =1.0.4, =2.1.0, =2.1.0, =2.1.0, =1.3.9, =1.4.6 - de.ihrigb.fwla:mail-handler 0.0.3 and more Source cves: CVE-2020-5413 Source advisory: OSV:GHSA-86QR-9VQC-PGC6...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.21), cc.cc4414:cc-spring-auth-server (>=0.5.0, <=0.7.0) +697 more potentially affected by CVE-2020-5413 via org.springframework.integration:spring-integration-core (>=5.1.0.release, <=5.1.11.release)

org.springframework.integration:spring-integration-core MAVEN version =5.1.0.release, =0.5.0, =0.5.0, =0.1.0, =0.3.0, =0.5.0, =0.3.0, =0.3.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.1.0, =0.1.0, =c.0.0.1, =c.0.0.1, =c.0.0.5 and more Source cves: CVE-2020-5413 Source advisory: GHSA-86QR-9VQC-PGC6...

ai.hyacinth.framework:core-service-bus-support (0.5.24), cc.cc4414:cc-spring-auth-server (0.5.1) +398 more potentially affected by CVE-2020-5413 via org.springframework.integration:spring-integration-core (>=5.2.0.release, <=5.2.7.release)

org.springframework.integration:spring-integration-core MAVEN version =5.2.0.release, =5.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: -...

ai.hyacinth.framework:core-service-bus-support (0.5.24), cc.cc4414:cc-spring-auth-server (0.5.1) +398 more potentially affected by CVE-2020-5413 via org.springframework.integration:spring-integration-core (>=5.2.0.release, <=5.2.7.release)

org.springframework.integration:spring-integration-core MAVEN version =5.2.0.release, =5.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: -...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.21), cc.cc4414:cc-spring-auth-server (>=0.5.0, <=0.7.0) +697 more potentially affected by CVE-2020-5413 via org.springframework.integration:spring-integration-core (>=5.1.0.release, <=5.1.11.release)

org.springframework.integration:spring-integration-core MAVEN version =5.1.0.release, =0.5.0, =0.5.0, =0.1.0, =0.3.0, =0.5.0, =0.3.0, =0.3.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.1.0, =0.1.0, =c.0.0.1, =c.0.0.1, =c.0.0.5 and more Source cves: CVE-2020-5413 Source advisory: OSV:GHSA-86QR-9VQC-PGC6...

cn.strongculture:prometheus-spring-boot-starter (1.0.0), com.buession.springcloud:buession-springcloud-stream (1.2.0) +90 more potentially affected by CVE-2020-5413 via org.springframework.integration:spring-integration-core (>=5.3.0.release, <=5.3.1.release)

org.springframework.integration:spring-integration-core MAVEN version =5.3.0.release, =2.3.0.5, =2.3.0, =2.3.0, =1.0.4, =1.0.10, =1.0.4, =1.0.4, =2.1.0, =2.1.0, =2.1.0, =1.3.9, =1.4.6 - de.ihrigb.fwla:mail-handler 0.0.3 and more Source cves: CVE-2020-5413 Source advisory: GHSA-86QR-9VQC-PGC6...