org.springframework.data:spring-data-rest-repository (1.0.0.release), org.springframework.data:spring-data-rest-webmvc (1.0.0.release) potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.3.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-repository 1.0.0.release ...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +3 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.12.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

org.springframework.data:spring-data-rest-core (2.0.3.release), org.springframework.data:spring-data-rest-webmvc (2.0.3.release) potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.13.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.13.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - org.springframework.data:spring-data-rest-core 2.0.3.release -...

be.personify.iam:personify-api (>=1.5.0.release, <=1.5.1.release), be.personify.iam:personify-frontend (1.5.1.release) +51 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (>=2.0.0, <=2.0.4)

org.springframework.hateoas:spring-hateoas MAVEN version =2.0.0, =1.5.0.release, =1.5.0.release, =0.2.6, =1.6.9, =1.0, =1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2.0.0, =2.0.4 - com.wizzdi:flexicore 7.0.0 and more Source cves: CVE-2023-34036 Source advisory: MEND:CVE-2023-34036...

io.jstach:jstachio-jmustache (0.10.0), io.jstach:jstachio-spring (0.10.0) +4 more potentially affected by CVE-2023-33962 via io.jstach:jstachio (0.10.0)

io.jstach:jstachio MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.jstach:jstachio and may be impacted: - io.jstach:jstachio-jmustache 0.10.0 - io.jstach:jstachio-spring 0.10.0 - io.jstach:jstachio-spring-example 0.10.0 -...

dk.mada.jaxrs:openapi-jaxrs-client (0.9.17), io.jstach:jstachio-jmustache (0.10.1) +5 more potentially affected by CVE-2023-33962 via io.jstach:jstachio (0.10.1)

io.jstach:jstachio MAVEN version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.jstach:jstachio and may be impacted: - dk.mada.jaxrs:openapi-jaxrs-client 0.9.17 - io.jstach:jstachio-jmustache 0.10.1 - io.jstach:jstachio-spring 0.10.1 -...

io.jstach:jstachio-jmustache (0.11.0), io.jstach:jstachio-spring (0.11.0) +4 more potentially affected by CVE-2023-33962 via io.jstach:jstachio (0.11.0)

io.jstach:jstachio MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.jstach:jstachio and may be impacted: - io.jstach:jstachio-jmustache 0.11.0 - io.jstach:jstachio-spring 0.11.0 - io.jstach:jstachio-spring-example 0.11.0 -...

io.jstach:jstachio-jmustache (0.14.0), io.jstach:jstachio-spring (0.14.0) +4 more potentially affected by CVE-2023-33962 via io.jstach:jstachio (0.14.0)

io.jstach:jstachio MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.jstach:jstachio and may be impacted: - io.jstach:jstachio-jmustache 0.14.0 - io.jstach:jstachio-spring 0.14.0 - io.jstach:jstachio-spring-example 0.14.0 -...

io.jstach:jstachio-jmustache (0.15.0), io.jstach:jstachio-spring (0.15.0) +4 more potentially affected by CVE-2023-33962 via io.jstach:jstachio (0.15.0)

io.jstach:jstachio MAVEN version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.jstach:jstachio and may be impacted: - io.jstach:jstachio-jmustache 0.15.0 - io.jstach:jstachio-spring 0.15.0 - io.jstach:jstachio-spring-example 0.15.0 -...

io.jooby:jooby-jstachio (3.0.0.m9), io.jstach:jstachio-jmustache (0.17.0) +5 more potentially affected by CVE-2023-33962 via io.jstach:jstachio (0.17.0)

io.jstach:jstachio MAVEN version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.jstach:jstachio and may be impacted: - io.jooby:jooby-jstachio 3.0.0.m9 - io.jstach:jstachio-jmustache 0.17.0 - io.jstach:jstachio-spring 0.17.0 -...

com.ibeetl:beetl-framework-starter (1.1.45.release), com.ibeetl:beetlsql (2.10.19) +1 more potentially affected by CVE-2023-30331 via com.ibeetl:beetl (2.7.28)

com.ibeetl:beetl MAVEN version 2.7.28 is affected by a known vulnerability. The following packages have a transitive dependency on com.ibeetl:beetl and may be impacted: - com.ibeetl:beetl-framework-starter 1.1.45.release - com.ibeetl:beetlsql 2.10.19 - net.ymate.platform:ymate-platform-webmvc...

Security Bypass

spring-webmvc is vulnerable to Security Bypass. The vulnerability exists because using "" as a pattern in spring security configuration with the mvcRequestMatcher which creates a mismatch in pattern matching between Spring Security and Spring MVC and the potential for a security bypass...

am.ik.webhook:webhook-verifier (>=0.1.0, <=0.1.1), be.tomcools:rickroll-security-spring-boot-starter (>=3.0.0, <=3.1.0) +1361 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=6.0.0, <=6.0.6)

org.springframework:spring-webmvc MAVEN version =6.0.0, =0.1.0, =3.0.0, =0.1.43, =1.0.0, =3.0.0, =2.0.0, =1.34.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-20860 Source advisory: GHSA-7PHW-CXX7-Q9VQ...

am.ik.webhook:webhook-verifier (>=0.1.0, <=0.1.1), be.tomcools:rickroll-security-spring-boot-starter (>=3.0.0, <=3.1.0) +1361 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=6.0.0, <=6.0.6)

org.springframework:spring-webmvc MAVEN version =6.0.0, =0.1.0, =3.0.0, =0.1.43, =1.0.0, =3.0.0, =2.0.0, =1.34.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-20860 Source advisory: OSV:GHSA-7PHW-CXX7-Q9VQ...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9149 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=5.3.0, <=5.3.25)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =1.4.2, =1.6.6, =j8.2.4.0, =j8.2.4.0, =j11.2.6.1 and more Source cves: CVE-2023-20860 Source advisory: GHSA-7PHW-CXX7-Q9VQ...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9149 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=5.3.0, <=5.3.25)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =1.4.2, =1.6.6, =j8.2.4.0, =j8.2.4.0, =j11.2.6.1 and more Source cves: CVE-2023-20860 Source advisory: OSV:GHSA-7PHW-CXX7-Q9VQ...

am.ik.webhook:webhook-verifier (>=0.1.0, <=0.1.1), be.tomcools:rickroll-security-spring-boot-starter (>=3.0.0, <=3.1.0) +1361 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=6.0.0, <=6.0.6)

org.springframework:spring-webmvc MAVEN version =6.0.0, =0.1.0, =3.0.0, =0.1.43, =1.0.0, =3.0.0, =2.0.0, =1.34.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-20860 Source advisory: MEND:CVE-2023-20860...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9149 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=5.3.0, <=5.3.25)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =1.4.2, =1.6.6, =j8.2.4.0, =j8.2.4.0, =j11.2.6.1 and more Source cves: CVE-2023-20860 Source advisory: MEND:CVE-2023-20860...

co.paralleluniverse:comsat-spring-boot (0.3.0), co.paralleluniverse:comsat-spring-webmvc (0.3.0) +156 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.0.8.release)

org.springframework:spring-expression MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3...