6976 matches found
The vulnerability of the Spring Framework software platform, related to unlimited resource distribution, allows attackers to cause service failures.
The vulnerability of the Spring Framework software platform is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by using a specially created SpEL expression...
The vulnerability of the Spring Core module of the Spring Framework software platform allows attackers to execute arbitrary code.
The vulnerability of the Spring Core module of the Spring Framework is related to the use of externally controlled input data for class selection. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Spring Cloud Function SpEL Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Spring Cloud Function SpEL Injection', 'Description' = %q Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code...
Spring Cloud Function Remote Code Execution (CVE-2022-22963)
A remote code execution vulnerability exists in Spring Cloud Function. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Spring Cloud Function SPEL Expression Injection (direct check)
Binary data springcloudCVE-2022-22963.nbin...
Exploit for Expression Language Injection in Vmware Spring_Cloud_Gateway
springclo...
Spring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965)
Rapid7 has completed remediating the instances of Spring4Shell CVE-2022-22965 and Spring Cloud CVE-2022-22963 vulnerabilities that we found on our internet-facing services and systems. For further information and updates about our internal response to Spring4Shell, please see our post here. If yo...
Exploit for Code Injection in Vmware Spring_Cloud_Function
PoC exploit for CVE-2022-22963, a Spring Core 0day vulnerability...
CVE-2022-27772
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...
CVE-2022-27772
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...
Directory traversal
UNSUPPORTED WHEN ASSIGNED spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects...
RCE Bug in Spring Cloud Could Be the Next Log4Shell, Researchers Warn
NOTE: This post is about the confirmed and patched vulnerability tracked as CVE-2022-22963. While the researchers at Sysdig refer to this Spring Cloud bug as “Spring4Shell,” it should be noted that there is some confusion as to what to call it, with another security firm referring to a different,...
CVE-2022-27772
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...
CVE-2022-27772
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...
CVE-2022-27772
CVE-2022-27772 : Spring Boot before v2.2.11.RELEASE is vulnerable to temporary directory hijacking via the method org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir. A local attacker could leverage this to escalate privileges or take over the application, as de...
Exploit for Code Injection in Vmware Spring_Cloud_Function
CVE-2022-22963 RCE PoC Minimal example to reproduce CVE-2022-...
Exploit for Code Injection in Vmware Spring_Framework
Spring Core RCE - CVE-2022-22965 After Spring Cloud, on Mar...
SpringCore0day
Information https://spring.io/blog/2022/03/31/spring-framewor...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Spring
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Spring. Vulnerability Details CVEID: CVE-2021-22060 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote authenticated attacker to bypass security restrictions, caused by improper input validation...