com.payneteasy.superfly:superfly-web (>=1.1-1, <=1.1-2), org.grails:grails-webflow (>=2.2.0.rc2, <=2.2.4) +9 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (2.5.6.sec01)

org.springframework:spring-webmvc MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.payneteasy.superfly:superfly-web =1.1-1, =2.2.0.rc2, =2.0.2, =1.0.0.release,...

com.payneteasy.superfly:superfly-web (>=1.1-1, <=1.1-2), org.grails:grails-webflow (>=2.2.0.rc2, <=2.2.4) +9 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.5.6.sec01)

org.springframework:spring-webmvc MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.payneteasy.superfly:superfly-web =1.1-1, =2.2.0.rc2, =2.0.2, =1.0.0.release,...

com.payneteasy.superfly:superfly-web (>=1.1-1, <=1.1-2), org.grails:grails-webflow (>=2.2.0.rc2, <=2.2.4) +9 more potentially affected by CVE-2026-41844 via org.springframework:spring-webmvc (2.5.6.sec01)

org.springframework:spring-webmvc MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.payneteasy.superfly:superfly-web =1.1-1, =2.2.0.rc2, =2.0.2, =1.0.0.release,...

com.payneteasy.superfly:superfly-web (>=1.1-1, <=1.1-2), org.grails:grails-webflow (>=2.2.0.rc2, <=2.2.4) +9 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (2.5.6.sec01)

org.springframework:spring-webmvc MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.payneteasy.superfly:superfly-web =1.1-1, =2.2.0.rc2, =2.0.2, =1.0.0.release,...

com.evasion:client (>=1.0.0.1, <=1.0.0.3), org.grails:grails-webflow (>=2.2.0.rc1, <=2.2.5) +12 more potentially affected by CVE-2024-22259 via org.springframework:spring-web (2.5.6.sec01)

org.springframework:spring-web MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.evasion:client =1.0.0.1, =2.2.0.rc1, =2.0.2, =1.0.0.release, =2.0.8.release,...

com.evasion:client (>=1.0.0.1, <=1.0.0.3), org.grails:grails-webflow (>=2.2.0.rc1, <=2.2.5) +12 more potentially affected by CVE-2024-22243 via org.springframework:spring-web (2.5.6.sec01)

org.springframework:spring-web MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.evasion:client =1.0.0.1, =2.2.0.rc1, =2.0.2, =1.0.0.release, =2.0.8.release,...

GHSA-8V4H-J42H-WFHC Deserialization of Untrusted Data in Spring-flex

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may b...

Design/Logic Flaw

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may b...

CVE-2017-3203

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may b...

CVE-2017-3203 Pivotal/Spring Spring-flex's Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may b...

CVE-2017-3203: Deserialization of Untrusted Data

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may b...

PT-2018-7252

Name of the Vulnerable Software and Affected Versions: Pivotal/Spring Spring-flex affected versions not specified Description: The issue concerns the Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex, which derive class instances from java.io.Externalizable instead of...

AMF3 Java implementations deserialization Vulnerability

Details reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers derive class instances from java. io. Externalizable rather than the AMF3 specification's recommendation of a flash. utils. IExternalizable. A remote attacker with the ability to...

Pivotal Spring Flex Remote Code Execution Vulnerability

Pivotal Spring Flex is an integrated BlazeDS client for teleprocessing and messaging from Pivotal Software, USA. A remote code execution vulnerability exists in Pivotal Spring Flex. An attacker can exploit the vulnerability to execute arbitrary code in the context of an affected application,...

Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references

Overview Several Java implementations of AMF3 are vulnerable to insecure deserialization and XML external entities references. Description Several Java implementations of Action Message Format AMF3 are vulnerable to one or more of the following implementation errors:CWE-502: Deserialization of...