africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +11844 more potentially affected by CVE-2025-41242 via org.springframework:spring-webmvc (>=5.3.0, <=5.3.39)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =1.4.2, =1.6.6, =1.6.6.1 - ai.platon:distributed-lock-example 1.4.2 and more Source cves: CVE-2025-41242 Source advisory: GHSA-R936-GWX5-V52F...

ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0), ai.fusionbrain:fusionbrain-spring-boot-starter (1.0.0) +5173 more potentially affected by CVE-2025-41242 via org.springframework:spring-webmvc (>=6.2.0, <=6.2.9)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.17.0, =0.1.1, =0.1.0, =0.0.1, =0.0.2 and more Source cves: CVE-2025-41242 Source advisory: GHSA-R936-GWX5-V52F...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-webmvc-5.3.27.jar

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of spring-webmvc-5.3.27.jar Vulnerability Details CVEID:CVE-2024-38828 DESCRIPTION: Spring MVC controller methods with an @RequestBody byte method parameter are vulnerable to a DoS attack. CWE:CWE-400: Uncontrolled Resource...

Path traversal vulnerability in functional web frameworks (CVE-2024-38819)

Spring Framework is vulnerable to a path traversal issue due to a lack of sufficient sanitization of path sequences processed by the WebMvc.fn or WebFlux.fn functional web frameworks. A remote attacker could submit crafted HTTP requests to an application that serves static resources through the...

Path Traversal (Arbitrary Read/Write) org.springframework:spring-webmvc Dependency in Jira Software Data Center and Server

This High severity org.springframework:spring-webmvc Dependency vulnerability was introduced in versions 9.12.0 Jira Software Data Center and Server. This org.springframework:spring-webmvc Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

Security Bulletin: Vulnerability in Spring WebMvc affects watsonx.data

Summary Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. This could affect watsonx.data. Vulnerability Details CVEID:CVE-2024-38819 DESCRIPTION: Applications serving static resources through the functiona...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to spring-webmvc-6.1.12 (CVE-2024-38816)

Summary IBM Sterling Connect:Direct Web Services uses spring webmvc jar, Spring Security could allow a remote attacker to obtain sensitive information, caused by a path traversal attack in applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux...

Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to spring-webmvc-6.1.12.jar CVE-2024-38816

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to spring-webmvc-6.1.12.jar CVE-2024-38816. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-38816 DESCRIPTION: VMware Tanzu Spring Security could allow a remote...

IDOR (Insecure Direct Object Reference) org.springframework:spring-webmvc Dependency in Confluence Data Center and Server

This High severity org.springframework:spring-webmvc Dependency vulnerability was introduced in version 3.0 of Confluence Data Center and Server. This org.springframework:spring-webmvc Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +43 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (4.0.2.release)

org.springframework:spring-webmvc MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +280 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (4.3.5.release)

org.springframework:spring-webmvc MAVEN version 4.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =0.0.25, =1.3.1, =0.0.25, =0.0.25,...

com.payneteasy.superfly:superfly-web (>=1.1-1, <=1.1-2), org.grails:grails-webflow (>=2.2.0.rc2, <=2.2.4) +9 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (2.5.6.sec01)

org.springframework:spring-webmvc MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.payneteasy.superfly:superfly-web =1.1-1, =2.2.0.rc2, =2.0.2, =1.0.0.release,...

org.geoserver:community (1.4.0_gt2.2.x), org.geoserver:platform (>=1.4.0-m1, <=1.4.0_gt2.2.x) +6 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (1.2.5)

org.springframework:spring-webmvc MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.geoserver:community 1.4.0gt2.2.x - org.geoserver:platform =1.4.0-m1, =1.4.0gt2.2.x -...

com.foreach.across.modules:bootstrap-ui-module (2.1.1.release), com.foreach.across.modules:dynamic-forms-module (0.0.2.release) +181 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (4.3.20.release)

org.springframework:spring-webmvc MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.foreach.across.modules:bootstrap-ui-module 2.1.1.release -...

au.com.mountain-pass:hyperstate (>=1, <=3), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.4) +277 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (4.2.4.release)

org.springframework:spring-webmvc MAVEN version 4.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - au.com.mountain-pass:hyperstate =1, =0.0.10, =11.0.0, =1.1.5-7, =0.1.0, =1.0.0.releas...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), ch.ralscha:extdirectspring (1.3.9) +54 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (3.2.5.release)

org.springframework:spring-webmvc MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - be.dnsbelgium:rdap-server =0.3.3, =0.4.1, =0.4.1, =0.4.1, =1.0.0, =0.3.0, =2.0.0,...

ar.com.jmfsg:api-doc (>=0.0.28, <=0.0.34), ch.ralscha:extdirectspring (>=1.3.2, <=1.3.5) +102 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (3.2.2.release)

org.springframework:spring-webmvc MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ar.com.jmfsg:api-doc =0.0.28, =1.3.2, =1.0.5-release, =0.9.12, =0.9.12, =0.9.12,...

org.springframework:spring-hibernate (1.2.4), org.springframework:spring-orm (1.2.4) +1 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (1.2.4)

org.springframework:spring-webmvc MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-hibernate 1.2.4 - org.springframework:spring-orm 1.2.4 -...

org.acegisecurity:acegi-security-samples-contacts (1.0.7), org.andromda.andromdapp.projects:andromda-andromdapp-project-richclient-ant (3.3) +1 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (1.2.9)

org.springframework:spring-webmvc MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.acegisecurity:acegi-security-samples-contacts 1.0.7 -...

cc.concurrent:config-server (0.1), ch.ralscha:extdirectspring (>=1.3.6, <=1.3.8) +186 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (3.2.4.release)

org.springframework:spring-webmvc MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cc.concurrent:config-server 0.1 - ch.ralscha:extdirectspring =1.3.6, =3.1.3, =3.1.3,...