This Week in Spring - September 2nd, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Frankfurt, awaiting my flight to the Java-tastic Javazone 2025 event where I'll be joined by the legendary James Ward to deliver an AI-focused look at the latest-and-greatest in Spring! And I'm still recovering from th...

The Road to GA - Introduction

As you all should be aware by now, the Spring portfolio is in the process of driving towards the next major versions to be released in November of this year. This will be only the fourth major generation for Spring Boot and the seventh major generation for Spring Framework in its over 20 year...

PT-2025-35558

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: The E3 Site Supervisor Control generates the root Linux password on each boot. An attacker can generate the root Linux password for a vulnerable device based on known or easily...

CVE-2022-38695

In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2022-38692

In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges...

PT-2025-51837

Name of the Vulnerable Software and Affected Versions Qualcomm embedded platform firmware affected versions not specified Description A memory corruption issue exists when loading invalid firmware during the boot process. This flaw is related to authorization mechanism deficiencies within the...

PT-2025-48445

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon affected versions not specified Description A flaw exists in Qualcomm Snapdragon chipsets related to insufficient input validation during buffer copying. Specifically, a corrupted ELF image with an oversized file size can b...

Exploit for CVE-2025-55349

CVE-2025-55349 — pm2 Arbitrary Code Execution via postinstall...

CVE-2025-25734

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units RSUs v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process...

Linux Distros Unpatched Vulnerability : CVE-2023-48733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS- resident attacker to bypass Secure Boot. CVE-2023-48733 No...

Linux Distros Unpatched Vulnerability : CVE-2023-40551

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's...

Linux Distros Unpatched Vulnerability : CVE-2019-14194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfsreadreply when calling storeblock in the...

Linux Distros Unpatched Vulnerability : CVE-2022-28734

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one...

Linux Distros Unpatched Vulnerability : CVE-2023-40548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE...

Linux Distros Unpatched Vulnerability : CVE-2024-6287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. When checking whether a new image invades/overlaps with a...

Linux Distros Unpatched Vulnerability : CVE-2023-4001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the passwo...

Linux Distros Unpatched Vulnerability : CVE-2024-2312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to ...

Linux Distros Unpatched Vulnerability : CVE-2018-18440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandled. CVE-2018-18440 No...

Linux Distros Unpatched Vulnerability : CVE-2022-28735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The GRUB2's shimlock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified...

Linux Distros Unpatched Vulnerability : CVE-2020-10648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a...