dependo

dependo A proof of concept for state-of-the-art observability...

WebMvc.fn/WebFlux.fn - Path Traversal Detection

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Spring Boot Actuator SBOM - Exposure Detection

Spring Boot Actuator SBOM endpoint was detected and is exposed without authentication. The endpoint returns a Software Bill of Materials typically CycloneDX or SPDX JSON listing every dependency and version shipped with the application, which lets an attacker enumerate the exact library inventory...

Xibo 1.2.2/1.4.1 - Directory Traversal Detection

A directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the p parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in Spring Signage...

Spring MVC Framework - Local File Inclusion Detection

Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. A malicious user can send a request using a...

Spring Cloud Config Server - Local File Inclusion Detection

Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafte...

Detects Springboot HTTP Exchanges Actuator

The exposed httpexchanges endpoint can leak recent HTTP request/response data, including URIs, headers, and status codes. !/usr/bin/env python3 -- coding: utf-8 -- """The exposed httpexchanges endpoint can leak recent HTTP request/response data, including URIs, headers, and st.""" from kittysploi...

Java Spring Detection

Detects Java Spring Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Java Spring Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Java Spring Detection', 'description': 'Detects Java Spring...

Spring Boot Actuators (Jolokia) XXE Detection

A vulnerability in Spring Boot Actuators's 'jolokia' endpoint allows remote attackers to perform an XML External Entities XXE attack and include content stored on a remote server as if it was its own. This has the potential to allow the execution of arbitrary code and/or disclosure of sensitive...

Spring Boot Information Panel - Detect

Spring Boot information panel displaying app name, version information, and other values was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot information panel displaying app name, version information, and other values was detected.""" from kittysploit import from...

Spring Boot LoggerConfig Actuator Panel - Detect

Spring Boot LoggerConfig Actuator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot LoggerConfig Actuator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Spring Boot...

Spring Boot `X-Application-Context` Header Exposure Detection

Detected the presence of the X-Application-Context header in HTTP responses, which can expose sensitive application context information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of the X-Application-Context header in HTTP responses, which can expose sensitive applic."""...

Spring Security OAuth2 Remote Command Execution Detection

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

Exploit for CVE-2026-16723

Fastjson 1.2.83 RCE Lab Environment CVE-2026-16723 Disc...

This Week in Spring - July 28th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! The title says in Spring , but here in the northern hemisphere, it's clearly the middle of summer. Hot! I'm sitting here on my laptop on a warm summer day, and my laptop is indeed hot because I've spent so much time outside...

Spring Framework STOMP CSRF Vulnerability (CVE-2025-41254)

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework:6.2.0 - 6.2.11, 6.1.0 - 6.1.23, 6.0.x - 6.0.29, 5.3.0 - 5.3.45, Older, unsupported versions are also affected...

spring-cloud-azure-starter-active-directory-b2c Privilege Escalation

The vulnerability of the spring-cloud-azure-starter-active-directory-b2c component of the Microsoft Azure Spring Apps cloud service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Boot [CVE-2026-40992, CVE-2026-41001]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Boot due to flaws in Mail auto-configuration and ArtemisEmbeddedConfigurationFactory CVE-2026-40992, CVE-2026-41001. Spring Boot is used as part of our microservices. These vulnerabilities have been addressed...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC or WebFlux CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846. Spring MVC is used as part of our microservices. These vulnerabilities have been addressed. Please read the detail...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Spring Framework is used as part of our microservices. These vulnerabilities have been addressed. Please read the detai...