starsea-mall 安全漏洞

starsea-mall is a springboot +thymeleaf based Xiaomi mall management system by StarSea99 individual developer. A security vulnerability exists in starsea-mall version 1.0, which originates from the parameter file file of the UploadController function in the file...

CVE-2024-13202

A vulnerability was found in wander-chu SpringBoot-Blog 1.0 and classified as problematic. This issue affects the function modifiyArticle of the file src/main/java/com/my/blog/website/controller/admin/PageController.java of the component Blog Article Handler. The manipulation of the argument...

CVE-2024-13200

A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/com/my/blog/website/interceptor/BaseInterceptor.java of the component HTTP POST Request Handler. The manipulation leads to improper access...

A Bootiful Podcast: Dr. Dave Syer on the new and nifty Spring gRPC project

Hi, Spring fans! In this installment I talk to the good and the great Dr. Dave Syer about the experimental! new Spring gRPC project!...

cy-fast SQL注入漏洞

cy-fast is a SpringBoot based rapid development framework by chenyi personal developer. A security vulnerability exists in cy-fast version 1.0, which is caused by a SQL injection in the parameter order...

SpringBoot-Blog 跨站脚本漏洞

SpringBoot-Blog is a Java blogging system for wand individual developers. A security vulnerability exists in SpringBoot-Blog version 1.0, which originates from the parameter content in file src/main/java/com/my/blog/website/controller/admin/PageController.java that can lead to a cross-site...

cy-fast 注入漏洞

cy-fast is a SpringBoot based rapid development framework by chenyi personal developer. An injection vulnerability exists in cy-fast version 1.0, which is caused by SQL injection in the parameter order...

cy-fast 注入漏洞

cy-fast is a SpringBoot based rapid development framework by chenyi personal developer. An injection vulnerability exists in cy-fast version 1.0, which is caused by SQL injection in the parameter order...

PT-2025-2058 · Wander Chu · Springboot-Blog

Name of the Vulnerable Software and Affected Versions: wander-chu SpringBoot-Blog version 1.0 Description: A critical vulnerability was found in the HTTP POST Request Handler component, specifically affecting the preHandle function of the BaseInterceptor.java file. This leads to improper access...

cy-fast 注入漏洞

cy-fast is a SpringBoot based rapid development framework by chenyi personal developer. An injection vulnerability exists in cy-fast version 1.0, which is caused by SQL injection in the parameter order...

This Week in Spring - January 7th, 2025

Hi, Spring fans, and happy new year! It's been another super seven days since we last spoke and, as always, there's a lot to cover so let's dive right into it! A long time in coming, but it's finally here! Hello DCO, Goodbye CLA: Simplifying Contributions to Spring the Spring AI hits just keep on...

Hello DCO, Goodbye CLA: Simplifying Contributions to Spring

The Spring team will be rolling out a simplified contribution process that replaces the requirement to sign a Contributor License Agreement CLA with a Developer Certificate of Origin DCO. The process will start this week with Spring Framework, Spring Security, & Spring Boot and then roll out to t...

My-Blog 代码问题漏洞

My-Blog is a Java blog system implemented by SpringBoot + Mybatis + Thymeleaf and other technologies, with beautiful pages, full functionality, easy deployment and perfect code. A code issue vulnerability exists in My-Blog version 1.0, which stems from improper handling of the file parameter,...

This Year in Spring - December 31st, 2024

Hi Spring fans! Happy New Year! And welcome to another installment of This Year in Spring! The year that was... I write this edition from a desk overlooking the beautiful jungle of Martinique, a beautiful island nation in the French Caribbean. I’m sipping some rhum martinique , enjoying the...

Authorization Bypass

org.springframework.security is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of locale-dependent exceptions in String.toLowerCase and String.toUpperCase, which could lead to authorization rules not functioning as intended...

A Bootiful Podcast: Intact's Luke Shannon

Hi, Spring fans! and happy holidays! in this installment I talk to Intact's Luke Shannon about their use of Spring, developer portals, and so much more...

Malicious code in react-spring-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4479151acbc242dd9b62ac68197121a3b973d6eb0b58d6a0ac6900f63b9fe1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12114 Malicious code in react-spring-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4479151acbc242dd9b62ac68197121a3b973d6eb0b58d6a0ac6900f63b9fe1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OSV-2024-1397 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=385326423 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/java.util.HashMap.get org.springframework.core.convert.TypeDescriptor.valueOf...

PT-2024-40646 · Spring · Spring

Name of the Vulnerable Software and Affected Versions: Spring versions affected versions not specified Description: The issue is related to a security exception in the org.springframework.expression.spel.ast.OpPlus.getValueInternal function, which is part of the Spring framework. The crash state...