6978 matches found
springframework: URL Parsing with Host Validation
A vulnerability was discovered in Spring Framework. Under certain conditions, an attacker might be able to trigger an open redirect. This issue can simplify the process of conducting a phishing attack against users of the deployment...
PT-2024-4070 · Unknown · Spring Cloud Data Flow
Name of the Vulnerable Software and Affected Versions: Spring Cloud Data Flow affected versions not specified Description: The issue is related to improper sanitization for upload paths in the Skipper server, allowing a malicious user with access to the server API to write arbitrary files to any...
A Bootiful Podcast: Tagir Valeev, Fellow Java Champion and IntelliJ IDEA Java legend
Hi, Spring fans! In today's installment we talk to Tagir Valeev, a fellow Java Champion and IntelliJ IDEA Java legend. Also: don't forget to try out the just-released Spring Boot 3.3 release!...
springframework: URL Parsing with Host Validation
A vulnerability was found in Spring Framework. Affected versions of this package are vulnerable to an Open Redirect when using UriComponentsBuilder to parse an externally provided URL and perform validation checks on the host of the parsed URL...
This Week in Spring - May 21st, 2024
Welcome to another installment of This Week in Spring! It's been yet another amazing and exciting week and with it a bevy of new releases. And of course, in about a week's time, we will find ourselves at Spring IO, ready to show a lot of these new things. Will you be there? I will! Anyway, let's...
Deploy and Scale Spring Batch in the Cloud – with Adaptive Cost Control
May 21, 2024, at 9 AM PST You can now use Azure Spring Apps to effectively run Spring Batch applications with adaptive cost control. You only pay when batch jobs are running, and you can simply lift and shift your Spring Batch jobs with no code change. Spring Batch is a framework for processing...
Exploit for Incorrect Authorization in Vmware Spring_Security
CVE-2022-22978-demo Example code for the CVE-2022-22978 vuln...
Improper Authorization org.springframework.security:spring-security-core Dependency in Confluence Data Center and Server
This High severity org.springframework.security:spring-security-core Dependency vulnerability was introduced in versions 1.0 of Confluence Data Center and Server. This org.springframework.security:spring-security-core Dependency vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of...
A Bootiful Podcast: Oleg Šelajev, Docker and Testcontainers legend
Hi, Spring and Testcontainers fans! In this interview, I talk to Oleg Šelajev...
This Week in Spring - May 14th, 2024
Hi, Spring fans! Welcome to another installment of This Week in Spring! This week's highlights in the Spring ecosystem emphasize the ongoing advancements and applications of Spring AI. The discussions range from exploring the impressive VectorStore abstraction and enhanced structured output suppo...
RHEL 7 : spring-webflow (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - spring-webflow: Data Binding Expression Vulnerability in Spring Web Flow CVE-2017-8039 - An issue was...
RHEL 8 : spring-framework (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - spring-framework: RCE via Data Binding on JDK 9+ CVE-2022-22965 Note that Nessus has not tested for this issue but...
Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to IBM Java
Summary IBM Sterling Connect:Direct Web Service uses IBM Java SE. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-40167 DESCRIPTION: Jetty is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP/1 request...
Spring AI - Structured Output
UPDATE: 04.06.2024 Adde snippets for using structured output with the new, fluent ChatClient API . UPDATE: 17.05.2024 Generic Types support for BeanOutputConverter added. Science works with chunks and bits and pieces of things with the continuity presumed, and Art works only with the continuities...
A Bootiful Podcast: Spring Boot cofounders Phil Webb and Dr. David Syer on the occasion of the 10th Anniversary of Spring Boot 1.0
Hi, Spring fans! In this installment I talk to cofounders Phil Webb and Dr. David Syer, on the occassion of the 10th Anniversary of Spring Boot...
Exploit for Code Injection in Vmware Spring_Cloud_Function
CVE-2022-22963 En las versiones 3.1.6, 3.2.2 y versiones anter...
Security Bulletin: Common vulnerabilities fixed in Cloudera Data Platform 7.1.9 HF2
Summary Fixes to common vulnerabilities discovered in Cloudera Data Platform 7.1.9 are available to download from Cloudera. Vulnerability Details CVEID:CVE-2021-28170 DESCRIPTION: Eclipse EE4J Jakarta Expression Language could allow a remote attacker to bypass security restrictions, caused by a...
Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to privilege escalation due to Spring-Web (CVE-2023-44794)
Summary IBM Sterling Connect:Direct Web Services uses Spring-Web. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-44794 DESCRIPTION: Dromara SaToken and SpringBoot could allow a remote authenticated attacker to gain elevated privileg...
This Week in Spring - May 7th, 2024
Hi, Spring fans! Welcome to another amazing installment of This Week in Spring! I'm in bellisima Rome, Italy, where I've just spent time in some fun meetings, and now I'm off to lovely London, UK, for Devoxx UK 2024. It's going to be amazing. If you're there, don't hesitate to say hi! I've got to...