at.molindo:molindo-notify (>=1.0.0-alpha-1, <=1.0.0-alpha-2), be.eliwan:ew-profiling-api (>=1.0, <=1.4) +1704 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (>=3.0.0.release, <=3.0.5.release)

org.springframework:spring-core MAVEN version =3.0.0.release, =1.0.0-alpha-1, =1.0, =1.0, =0.7, =2.0-beta1, =1.1.1, =1.0.2, =1.1.2, =1.2, =1.0.0, =1.0.0, =1.1.0, =3.3.0, =3.4.1 and more Source cves: CVE-2011-2730 Source advisory: OSV:GHSA-WV88-PF73-X22P...

net.sourceforge.jsf-comp:acegi-jsf (1.1.3), net.sourceforge.openutils:openutils-usermanagement-dataobjects (2.0) +39 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (1.2.9)

org.springframework:spring-core MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - net.sourceforge.jsf-comp:acegi-jsf 1.1.3 -...

org.acegisecurity:acegi-security-tiger (1.0.0-rc1), org.apache.directory.mina:mina-integration-spring (>=0.9.1, <=0.9.5) +23 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (1.2.5)

org.springframework:spring-core MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.acegisecurity:acegi-security-tiger 1.0.0-rc1 -...

org.springframework:spring-aop (1.2.2), org.springframework:spring-beans (1.2.2) +10 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (1.2.2)

org.springframework:spring-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.2 - org.springframework:spring-beans 1.2.2 -...

org.springframework:spring-aop (1.2.4), org.springframework:spring-beans (1.2.4) +10 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (1.2.4)

org.springframework:spring-core MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.4 - org.springframework:spring-beans 1.2.4 -...

net.sf.dobo:dobo (1.0) potentially affected by CVE-2011-2730 via org.springframework:spring-core (1.2)

org.springframework:spring-core MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - net.sf.dobo:dobo 1.0 Source cves: CVE-2011-2730 Source advisory: OSV:GHSA-WV88-PF73-X22P...

org.springframework:spring-aop (1.2.1), org.springframework:spring-beans (1.2.1) +10 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (1.2.1)

org.springframework:spring-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.1 - org.springframework:spring-beans 1.2.1 -...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), ai.mattmann.mnemosyne:cas-cli (>=1.11.0, <=1.13.8) +3228 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (>=2.0-m1, <=2.5.6.sec02)

org.springframework:spring-core MAVEN version =2.0-m1, =1.3, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.13.8 - au.com.centrumsystems:build-pipeline-plugin 1.0 and more Source cves: CVE-2011-2730 Source advisory:...

at.molindo:molindo-notify (>=1.0.0-alpha-1, <=1.0.0-alpha-2), be.eliwan:ew-profiling-api (>=1.0, <=1.4) +1704 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (>=3.0.0.release, <=3.0.5.release)

org.springframework:spring-core MAVEN version =3.0.0.release, =1.0.0-alpha-1, =1.0, =1.0, =0.7, =2.0-beta1, =1.1.1, =1.0.2, =1.1.2, =1.2, =1.0.0, =1.0.0, =1.1.0, =3.3.0, =3.4.1 and more Source cves: CVE-2011-2730 Source advisory: GHSA-WV88-PF73-X22P...

com.discursive.dao.generic:generic-dao (1.0), com.discursive.taglib.reference:reference-taglib (1.0.1) +36 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (1.2.7)

org.springframework:spring-core MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.discursive.dao.generic:generic-dao 1.0 - com.discursive.taglib.reference:reference-taglib 1.0...

Privilege Escalation

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

The Spring Framework tags EL expressions to perform vulnerability analysis CVE-2 0 1 1-2 7 3 0-a vulnerability warning-the black bar safety net

0x00 Preface This vulnerability has been out for a long time, the previous simple analysis, but due to time constraints, no in-depth study of principles, the online on this vulnerability analysis is also not too much recently due to work reasons, in-depth analysis about the vulnerability of the...

Important: Red Hat Security Advisory: Red Hat JBoss Portal 5.2.2 security update

Red Hat JBoss Portal 5.2.2 roll up patch 1, which fixes multiple security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores,...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 update

JBoss Enterprise Application Platform 5.2.0, which fixes multiple security issues, various bugs, and adds several enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), ai.mattmann.mnemosyne:cas-cli (>=1.11.0, <=1.13.8) +3287 more potentially affected by CVE-2011-2730 via org.springframework:spring-core (>=1.2, <=2.5.6.sec02)

org.springframework:spring-core MAVEN version =1.2, =1.3, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.13.8 - au.com.centrumsystems:build-pipeline-plugin 1.0 and more Source cves: CVE-2011-2730 Source advisory:...

CVE-2011-2730

CVE-2011-2730 concerns VMware SpringSource Spring Framework (versions 2.5.6.SEC03, 2.5.7.SR023, and 3.x prior to 3.0.6) where EL-enabled containers evaluate EL expressions in several Spring tags twice, enabling an attacker to obtain sensitive information from attributes such as name, path, argume...

Debian Security Advisory DSA 2504-1 (libspring-2.5-java)

The remote host is missing an update to libspring-2.5-java announced via advisory DSA 2504-1. OpenVAS Vulnerability Test $Id: deb25041.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2504-1 libspring-2.5-java Authors: Thomas Reinke Copyright: Copyright c 20...

[SECURITY] [DSA 2504-1] libspring-2.5-java security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2504-1 [email protected] http://www.debian.org/security/ Florian Weimer June 28, 2012 http://www.debian.org/security/faq -...

Debian DSA-2504-1 : libspring-2.5-java - information disclosure

It was discovered that the Spring Framework contains an information disclosure vulnerability in the processing of certain Expression Language EL patterns, allowing attackers to access sensitive information using HTTP requests. NOTE: This update adds a springJspExpressionSupport context parameter...

[SECURITY] [DSA 2504-1] libspring-2.5-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2504-1 [email protected] http://www.debian.org/security/ Florian Weimer June 28, 2012 http://www.debian.org/security/faq -...