Exploit for Code Injection in Vmware Spring_Framework

Spring4Shell: CVE-2022-22965 RCE Java Spring framework RCE...

io.jstach:jstachio-jmustache (0.11.0), io.jstach:jstachio-spring (0.11.0) +4 more potentially affected by CVE-2023-33962 via io.jstach:jstachio (0.11.0)

io.jstach:jstachio MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.jstach:jstachio and may be impacted: - io.jstach:jstachio-jmustache 0.11.0 - io.jstach:jstachio-spring 0.11.0 - io.jstach:jstachio-spring-example 0.11.0 -...

Security Bypass

spring-webmvc is vulnerable to Security Bypass. The vulnerability exists because using "" as a pattern in spring security configuration with the mvcRequestMatcher which creates a mismatch in pattern matching between Spring Security and Spring MVC and the potential for a security bypass...

am.ik.webhook:webhook-verifier (>=0.1.0, <=0.1.1), be.tomcools:rickroll-security-spring-boot-starter (>=3.0.0, <=3.1.0) +1361 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=6.0.0, <=6.0.6)

org.springframework:spring-webmvc MAVEN version =6.0.0, =0.1.0, =3.0.0, =0.1.43, =1.0.0, =3.0.0, =2.0.0, =1.34.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-20860 Source advisory: GHSA-7PHW-CXX7-Q9VQ...

am.ik.webhook:webhook-verifier (>=0.1.0, <=0.1.1), be.tomcools:rickroll-security-spring-boot-starter (>=3.0.0, <=3.1.0) +1361 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=6.0.0, <=6.0.6)

org.springframework:spring-webmvc MAVEN version =6.0.0, =0.1.0, =3.0.0, =0.1.43, =1.0.0, =3.0.0, =2.0.0, =1.34.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-20860 Source advisory: OSV:GHSA-7PHW-CXX7-Q9VQ...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9147 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=5.3.0, <=5.3.25)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =1.4.2, =1.6.6, =j8.2.4.0, =j8.2.4.0, =j11.2.6.1 and more Source cves: CVE-2023-20860 Source advisory: GHSA-7PHW-CXX7-Q9VQ...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9147 more potentially affected by CVE-2023-20860 via org.springframework:spring-webmvc (>=5.3.0, <=5.3.25)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =1.4.2, =1.6.6, =j8.2.4.0, =j8.2.4.0, =j11.2.6.1 and more Source cves: CVE-2023-20860 Source advisory: MEND:CVE-2023-20860...

co.paralleluniverse:comsat-spring-boot (0.3.0), co.paralleluniverse:comsat-spring-webmvc (0.3.0) +156 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.0.8.release)

org.springframework:spring-expression MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3...

Security Bulletin: IBM Case Manager is affected but not classified as vulnerable to a remote code execution in Spring Framework [CVE-2022-22965]

Summary IBM Case Manager is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965. To be vulnerable a product must meet all of the following criterias: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast t...

Information Disclosure

spring-data-rest-webmvc is vulnerable to information disclosure. The vulnerability exists due to the improper implementation of the JSON patch in the library, allowing an attacker to get information about the hidden entity attributes through maliciously crafted HTTP requests...

Security Bulletin: IBM Sterling B2B Integrator is affected by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Sterling B2B Integrator is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spri...

Security Bulletin: IBM Spectrum Symphony is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Spectrum Symphony is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spring Boo...

Security Bulletin: HMC is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary HMC is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spring Boot executable jar, ...

Security Bulletin: IBM Security SOAR is affected but not classified as vulnerable to remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Security SOAR is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spring Boot...

Security Bulletin:IBM Common Licensing is affected but not classified as vulnerable by a remote code execution in Spring Framework (220575,CVE-2022-22965)

Summary IBM Common Licensing is affected but not classified as vulnerable to a remote code execution in Spring Framework 220575, CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a...

Security Bulletin: IBM Sterling Control Center is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Sterling Control Center is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spri...

org.springframework:spring-portlet (2.0-m1), org.springframework:spring-remoting (2.0-m1) +1 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (2.0-m1)

org.springframework:spring-web MAVEN version 2.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0-m1 - org.springframework:spring-remoting 2.0-m1 -...

org.springframework.security:spring-security-cas (5.0.18.release), org.springframework.security:spring-security-oauth2-client (5.0.18.release) +8 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.0.18.release)

org.springframework:spring-web MAVEN version 5.0.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework.security:spring-security-cas 5.0.18.release -...

org.springframework:spring-hibernate (1.2.3), org.springframework:spring-mock (1.2.3) +3 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (1.2.3)

org.springframework:spring-web MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.3 - org.springframework:spring-mock 1.2.3 -...