Michael Stepankin OpenID-Connect-Java-Spring-Server 代码问题漏洞

Michael Stepankin OpenID-Connect-Java-Spring-Server is a GlobalMichael Stepankin open source application system provides OpenID Connect identity provider and generic OAuth 2.0 authorization server Michael Stepankin OpenID-Connect-Java-Spring-Server suffers from a server-side request forgery...

USN-4774-1: Spring Framework vulnerabilities

Toshiaki Maki discovered that Spring Framework incorrectly handled certain XML files. A remote attacker could exploit this with a crafted XML file to cause a denial of service. CVE-2015-3192 Alvaro Muñoz discovered that Spring Framework incorrectly handled certain URLs. A remote attacker could...

The vulnerabilities of Azure Container Instance, Azure Service Fabric, Azure Kubernetes Service, Azure Container Registry, and Azure Spring Cloud involve a lack of protection for service data, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of Azure Container Instance, Azure Service Fabric, Azure Kubernetes Service, Azure Container Registry, and Azure Spring Cloud are related to the lack of protection for service data. Exploiting these vulnerabilities can allow an attacker operating remotely to gain unauthorized...

Logic flaw vulnerability in oasys

oasys is an OA office automation system , the use of Maven for project management , springboot framework based on the development of the project , mysql underlying database , the front-end freemarker template engine , Bootstrap as the front-end UI framework , integrated jpa, mybatis and other...

PT-2021-2279 · Microsoft · Azure Container Instance +5

Name of the Vulnerable Software and Affected Versions: Azure Virtual Machine versions affected versions not specified Azure Container Instance versions affected versions not specified Azure Service Fabric versions affected versions not specified Azure Kubernetes Service versions affected versions...

GitHub Security Lab: Java : Add a query to detect Spring View Manipulation Vulnerability

This bug was reported directly to GitHub Security Lab...

Arbitrary File Rewrite

spring-integration-zip is vulnerable to an arbitrary file rewrite aka a zip slip vulnerability. An incomplete fix of CVE-2018-1263 allows an attacker to send a malicious zip archive bzip2, tar, xz, war, cpio, 7z with path traversal filenames, leading to writing of files outside of the target...

The vulnerability of the Java framework’s LDAP module for securing Spring-based industrial applications allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the LDAP module of the Java framework for securing Spring-based industrial applications is related to authentication errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the OAuth component of the Java framework for securing Spring-based industrial applications allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the OAuth component in the Java framework for securing Spring-based industrial applications relates to the redirection of URLs to an unreliable website. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

Path traversal

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

CVE-2021-22114 concerns a path-traversal vulnerability in Spring Integration Zip handling. Connected sources indicate that Spring-integration-zip versions prior to 1.0.4 expose an arbitrary file write vulnerability via specially crafted zip archives (also affecting other archive formats like tar,...

Spring-integration-zip 路径遍历漏洞

Spring Spring-integration-zip is Spring an open source application . Provides compression and decompression functionality A path traversal vulnerability exists in Spring-integration-zip versions prior to 1.0.4, which stems from an arbitrary file write vulnerability...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Spring

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Spring. Vulnerability Details CVEID: CVE-2020-5421 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation. By using a...

SpringBootVulExploit

This repository contains a collection of Spring Boot vulnerability exploit checklists, including information on how to exploit various vulnerabilities in Spring Boot applications. The repository includes several subdirectories, each containing a specific exploit: 1...

Zip-slip mitigation bypass in Spring Integration Zip extension

spring-integration-zip , versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So when the filename gets concatenated to...

CVE-2021-22112

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen it must be programmed in...