CVE-2024-24061

springboot-manager v1.6 is vulnerable to Cross Site Scripting XSS via /sysContent/add...

PT-2024-20257

Name of the Vulnerable Software and Affected Versions springboot-manager version 1.6 Description The system does not filter the suffixes of uploaded files, allowing for Arbitrary File Upload. Recommendations For springboot-manager version 1.6, consider implementing file type validation to restric...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2024-22497 Source...

io.apiman:apiman-distro-wildfly8 (>=1.0.0.beta2, <=1.0.0.final), io.apiman:apiman-manager-ui-war-wildfly8 (>=1.0.0.beta2, <=1.0.2.final) +71 more potentially affected by CVE-2023-6927 via org.keycloak:keycloak-core (1.1.0.beta2)

org.keycloak:keycloak-core MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman:apiman-distro-wildfly8 =1.0.0.beta2, =1.0.0.beta2, =1.0.0.beta2, =2.0.16, =2.0.20, =2.2.28 ...

mldong Code Injection Vulnerability

mldong is mldong individual developer based on SpringBoot + Vue3 rapid development platform , self-research workflow engine . mldong 1.0 version of the code injection vulnerability , the vulnerability stems from the file com/mldong/modules/wf/engine/model/DecisionModel.java ExpressionEngine...

Exploit for Expression Language Injection in Vmware Spring_Cloud_Gateway

开源工具 SpringBoot-Scan 的GUI图形化版本，对你有用的话麻烦点个Star哈哈 注意：本工具内置相关漏洞的Exp，杀软报毒属于正常现象！ 新版本工具使用 python3 main.py VulHub 漏洞测试环境搭建 git clone https://github.com/vulhub/vulhub.git 安装Docker环境 sudo apt-get install docker.io sudo apt install docker-compose 搭建CVE-2022-22965 cd /vulhub/CVE-2022-22965 sudo...

PT-2023-28728 · Jfinalcms +1 · Jfinalcms +1

Name of the Vulnerable Software and Affected Versions: SpringbootCMS version 1.0 JFinalcms affected versions not specified Description: The issue exists in a newly created part of the background, where parameters submitted by users are not filtered. This allows special characters in parameters to...

com.diabolicallabs:vertx-process-manager (0.8), io.fabric8.quickstarts:springboot-camel-drools (>=2.2.126, <=2.2.149) +15 more potentially affected by CVE-2022-1415 via org.drools:drools-core (6.4.0.final)

org.drools:drools-core MAVEN version 6.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - com.diabolicallabs:vertx-process-manager 0.8 - io.fabric8.quickstarts:springboot-camel-drools =2.2.126, =0.0....

com.gitee.starblues:springboot-plugin-framework (>=1.0-release, <=2.1.4-release), com.gitee.starblues:springboot-plugin-framework-extension-mybatis (>=2.0-release, <=2.1.4-release) +36 more potentially affected by CVE-2023-40827 via org.pf4j:pf4j (2.6.0)

org.pf4j:pf4j MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.gitee.starblues:springboot-plugin-framework =1.0-release, =2.0-release, =1.0.8.release, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0,...

MarsCTF code-related vulnerabilities

MarsCTF is a Vue + Springboot developed CTF learning platform by b1ackc4t individual developer. A security vulnerability exists in MarsCTF version 1.2.1, which stems from an arbitrary file upload vulnerability in the background upload attachment interface...

Spring Tips: go fast with Spring Boot 3.1

Hi, Spring fans! In this installment, Josh Long @coffeesoftware looks at how the new Spring Boot 3.1 release delivers incredible efficiencies for both developers and machines. Java springboot Microservices Testcontainers GraalVM Docker DockerCompose Devtools SSL...

This Week in Spring - SpringOne Essentials 2023 edition - January 24th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! Today is a very day for you see, today we kick off SpringOne Essentials, the online incarnation of SpringOne, online. We'll see you live, on stream, in just a few hours!. SpringOne Essentials is going to be amazing, but befor...

Exploit for Code Injection in Apache Commons_Text

CVE-2022-42889 a.k.a. Text4Shell RCE Proof of Concept !ima...

U.S. Dept Of Defense: springboot actuator is leaking internals at ██████████

Proof of Concept If you go to https://█████████/actuator you'll get a complete overview of all the endpoints that are accessable Suggestion: Use a Firefox Browser if possible, its json representation is well formed and the links are clickable ██████████ Impact Information Disclosure...

com.diabolicallabs:vertx-process-manager (0.8), io.fabric8.quickstarts:springboot-camel-drools (>=2.2.126, <=2.2.149) +15 more potentially affected by CVE-2021-41411 via org.drools:drools-core (6.4.0.final)

org.drools:drools-core MAVEN version 6.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.drools:drools-core and may be impacted: - com.diabolicallabs:vertx-process-manager 0.8 - io.fabric8.quickstarts:springboot-camel-drools =2.2.126, =0.0....

Exploit for Code Injection in Vmware Spring_Cloud_Function

CVE-2022-22963 - Spring4shell To run the vulnerable SpringBoot...

OneBlog Cross-Site Scripting Vulnerability

OneBlog is a simple and beautiful , powerful and adaptive Java blog. The use of springboot development , front-end use Bootstrap. support for mobile adaptive , with a complete front-end and back-end management functions . OneBlog in version 2.2.8 before the existence of XSS vulnerability , the...

Huaxia ERP system has information leakage vulnerability

Huaxia ERP based on the SpringBoot framework and SaaS model for small and medium-sized enterprises to provide open source ERP software , currently focusing on sales and inventory financial production functions . Huaxia ERP system has an information leakage vulnerability that can be exploited by...

SQL injection vulnerability in MCMS (CNVD-2021-50953)

MCMS is a development template based on SpringBoot 2 architecture , front-end based on vue, element ui . MCMS suffers from a SQL injection vulnerability, which can be exploited by an attacker to obtain sensitive database information...

SQL Injection Vulnerability in CicadasCMS

CicadasCMS is a CMS developed with springboot+mybatis+beetl. CicadasCMS suffers from a SQL injection vulnerability, which can be exploited by an attacker to obtain sensitive information from the database...