6980 matches found
This Week in Spring - May 7th, 2024
Hi, Spring fans! Welcome to another amazing installment of This Week in Spring! I'm in bellisima Rome, Italy, where I've just spent time in some fun meetings, and now I'm off to lovely London, UK, for Devoxx UK 2024. It's going to be amazing. If you're there, don't hesitate to say hi! I've got to...
Spring Tips: Vector Databases with Spring AI
Hi, Spring fans! In this installment, we look at the amazing support for vector databases in Spring AI...
Roothub 安全漏洞
Roothub is a forum system developed using SSM and MySQL. A security vulnerability exists in Roothub v2.6, which was discovered to contain an SQL injection vulnerability via the topic parameter in the list function...
Security Bulletin: VMware Tanzu Spring Framework is vulnerable to multiple security CVEs used in IBM Maximo Application Suite - Monitor Component
Summary IBM Maximo Application Suite - Monitor Component uses VMWare Tanzu Spring Framework which is vulnerable to multiple security CVEs. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-22262 DESCRIPTION: VMware Tanzu Spring Framewo...
A Bootiful Podcast: Carl Azoury, Zenika founder and CEO
Hi, Spring fans! In this installment I talk to Zenika founder and CEO Carl Azoury, and friend to the community and a part of the Spring story for decades...
Exploit for Code Injection in Vmware Spring_Framework
SpringFrameworkCVE-2022-22965RCE SpringFramework 远程代码执行漏洞CVE...
Spring Tips: Beans, Beans: What's in a Spring bean?
Hi, Spring fans! In this installment we explore the essential Spring bean. What are they, how are they created, and what do they mean to you?...
CVE-2024-29466
Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component...
OSV-2024-335 Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67978 Crash type: Security exception Crash state: org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp java.base/java.nio.charset.CharsetEncoder.replaceWith java.base/java.nio.charset.CharsetEncoder...
CVE-2024-29466
Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component...
Spring Tips: Spring Cloud Gateway for Spring MVC
Hi, Spring fans! In this installment, we revisit Spring Cloud Gateway, this time to look at the fantastic new support for Spring MVC, made all the more amazing by Java 21's virtual threads...
CVE-2024-29466
Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component...
This Week in Spring - April 30th, 2024
Welcome to yet another amazing installment of This Week in Spring! As usual, we've got a ton of stuff to get into, so let's dive right into it! Chris Bono announces the new versions of Spring Functions Catalog and Spring Cloud Streams Applications In last week's installment of A Bootiful Podcast,...
spring boot online exam 安全漏洞
Online Exam System is an online exam system by orotnom23 individual developers. A security vulnerability exists in spring boot online exam version v.0.9. An attacker can exploit this vulnerability to execute arbitrary code via the FileTransUtil.java component...
RHEL 7 / 8 : OpenShift Container Platform 4.10.56 (RHSA-2023:1655)
The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1655 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...
RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3622)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3622 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...
A Bootiful Podcast: Daniel Garnier-Moiroux on Passkeys and Spring Security
Hi, Spring fans! In this installment, I talk to my friend and colleague Daniel Garnier-Moiroux about the amazing awesome implications of passkeys in a Spring Security application...
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to phishing attacks in VMware Tanzu Spring Framework [CVE-2024-22243]
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to phishing attacks in VMware Tanzu Spring Framework, caused by an open redirect vulnerability when using UriComponentsBuilder to parse an externally provided URL CVE-2024-22243. VMware Tanzu Spring Framework is...
GHSA-8P5R-6MVV-2435 OpenMetadata vulnerable to a SpEL Injection in `PUT /api/v1/events/subscriptions` (`GHSL-2023-251`)
SpEL Injection in PUT /api/v1/events/subscriptions GHSL-2023-251 Please note, only authenticated users have access to PUT / POST APIS for /api/v1/policies. Non authenticated users will not be able to access these APIs to exploit the vulnerability. A user must exist in OpenMetadata and have...