Spring Office Hours Podcast: S5E19 - Docker, Compose, Testcontainers, Oh My!

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun will discuss some of the new features around Docker, Testcontainers and the Spring Boot plugin. You can participate in our live stream to ask questions or catch the replay on your...

jshERP path traversal vulnerability

jshERP Huaxia ERP is a domestic ERP system developed by Ji Shenghua. Versions of jshERP 3.6 and earlier had a path traversal vulnerability. This vulnerability stemmed from incorrect handling of the parameter “path” in the file /jshERP-boot/plugin/installByPath, which could lead to path traversal...

CVE-2026-1549: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may ...

com.alipay.sofa:rpc-sofa-boot-plugin (>=5.4.4, <=5.5.3), com.alipay.sofa:sofa-tracer-sample-with-sofarpc (>=2.1.0, <=3.0.3) potentially affected by CVE-2024-23636 via com.alipay.sofa:rpc-sofa-boot-starter (>=5.4.0, <=5.5.3)

com.alipay.sofa:rpc-sofa-boot-starter MAVEN version =5.4.0, =5.4.4, =2.1.0, =3.0.3 Source cves: CVE-2024-23636 Source advisory: OSV:GHSA-7Q8P-9953-PXVR...

com.alipay.sofa:rpc-sofa-boot-plugin (>=5.4.4, <=5.5.3), com.alipay.sofa:sofa-tracer-sample-with-sofarpc (>=2.1.0, <=3.0.3) potentially affected by CVE-2024-23636 via com.alipay.sofa:rpc-sofa-boot-starter (>=5.4.0, <=5.5.3)

com.alipay.sofa:rpc-sofa-boot-starter MAVEN version =5.4.0, =5.4.4, =2.1.0, =3.0.3 Source cves: CVE-2024-23636 Source advisory: GHSA-7Q8P-9953-PXVR...

com.alibaba:dubbo-registry-nacos (0.0.1), com.alipay.sofa:rpc-sofa-boot-core (>=5.5.0, <=6.0.1) +2 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.6.0)

com.alibaba.nacos:nacos-client MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba:dubbo-registry-nacos 0.0.1 - com.alipay.sofa:rpc-sofa-boot-core =5.5.0, =5.5.0, =5.5.0,...