7886 matches found
CVE-2020-17510
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...
CVE-2020-17510
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass...
SpringBootVulExploit
This repository contains a collection of Spring Boot vulnerability exploit checklists, which are used for authorized testing and security research purposes. The repository includes various exploits and techniques for exploiting Spring Boot applications, including: 1. Spring Boot Vulnerability...
PT-2020-6901 · Apache +2 · Apache Shiro +2
Name of the Vulnerable Software and Affected Versions: Apache Shiro versions prior to 1.7.0 Description: The issue is related to an authentication bypass when Apache Shiro is used with Spring. A specially crafted HTTP request may cause this bypass, potentially allowing a remote attacker to exploi...
Semrush: Critically Sensitive Spring Boot Endpoints Exposed
Spring Boot includes a number of additional features to help you monitor and manage your application when you push it to production. Hacker found that actuator endpoints containing potentially sensitive data such as internal tokens and service data were left public. Semrush has a microservices...
PT-2022-2032
Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.2.20 and 5.3.18 Spring Boot versions prior to 2.5.12 and 2.6.6 libspring-aop-java - 4.3.22-4ubuntu0.1esm1 libspring-beans-java - 4.3.22-4ubuntu0.1esm1 libspring-context-java - 4.3.22-4ubuntu0.1esm1...
intercityspringservice.com Cross Site Scripting vulnerability OBB-1455279
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
jackson-databind: Serialization gadgets in org.springframework:spring-aop
A flaw was found in jackson-databind 2.x. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
The vulnerability of the Kryo Codec component in the software platform for integrating corporate applications in Spring Integration allows a hacker to execute arbitrary code.
The vulnerability of the Kryo Codec component in the software platform for integrating corporate applications in Spring Integration is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Stripo Inc: Memory Dump and Env Disclosure via Spring Boot Actuator
Memory Dump and Env Disclosure via Spring Boot Actuator Spring boot actuator files/endpoints can be accessed via path like stripo.email/██████/actuator/, including a 110 MB heapdump file, which expose source code, private keys and some internal data! The maximum severity of this asset is medium, ...
Exploit for Path Traversal in Pivotal_Software Spring_Framework
Web-Security-Learning 项目地址： https://github.com/CHYbeta/Web-Security-Learning 知识星球【漏洞攻防】：https://t.zsxq.com/mm2zBeq 目录： - Web-Security-Learning - Web Security - sql注入 - MySql - MSSQL - PostgreSQL - MongoDB - 技巧 - 工具 - XSS - CSRF - 其他前端安全 - SSRF - XXE - JSONP注入 - SSTI - 代码执行 / 命令执行 - 文件包含 - 文件上传 /...
SQL Injection Vulnerability in ERP-PRO
ERP-PRO is based on SpringBoot 2.X framework for small and medium-sized enterprises to build open source good ERP software. ERP-PRO suffers from SQL injection vulnerability. Attackers can exploit the vulnerability to obtain sensitive information in the database...
Spring-webmvc command execution vulnerability in hessian-based remote service calls
spring-webmvc is a java development framework. A command execution vulnerability exists in spring-webmvc's hessian-based remote service invocation, which can be exploited by an attacker to gain control of the server...
Low: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.10 security update
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
The vulnerability of the spring-cloud-config-server module of the Spring Cloud Config server allows a attacker to gain access to protected information.
The vulnerability of the spring-cloud-config-server module in the Spring Cloud Config server exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected informatio...
The vulnerability of the spring-aop component of the Jackson-databind library in the FasterXML project allows a hacker to execute arbitrary code.
The vulnerability of the spring-aop component of the Jackson-databind library in the FasterXML project is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code on the target system...
Unauthorized Access Vulnerability in Huaxia ERP
Huaxia ERP based on SpringBoot framework , aspires to provide small and medium-sized enterprises with open source and good ERP software , currently focusing on sales and inventory + financial functions . Huaxia ERP has an unauthorized access vulnerability that can be exploited by attackers to...
Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.6.SP2 security update
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Vulnerability fixed in Spring Framework
There is a vulnerability in the Spring Framework that enables a Reflected File Download RFD attack. This vulnerability has already been patched NCSC-2015-0888, but researchers have found a way to bypass the mitigation. Pivotal has released new versions of the Spring Framework in which the...
