au.com.mountain-pass:hyperstate (>=1, <=9), biz.grundner.vaadin-in-spring:spring-vaadin (1.0) +554 more potentially affected by CVE-2016-6652 via org.springframework.data:spring-data-jpa (>=1.0.1.release, <=1.9.5.release)

org.springframework.data:spring-data-jpa MAVEN version =1.0.1.release, =1, =1.4, =1.4, =0.62, =0.79, =0.70, =0.78, =0.84 and more Source cves: CVE-2016-6652 Source advisory: GHSA-XR4V-28RM-PVGW...

au.com.mountain-pass:hyperstate-client (>=1, <=10), au.com.mountain-pass:hyperstate-client-webdriver (>=1, <=10) +102 more potentially affected by CVE-2016-6652 via org.springframework.data:spring-data-jpa (>=1.10.0.release, <=1.10.3.release)

org.springframework.data:spring-data-jpa MAVEN version =1.10.0.release, =1, =1, =1, =1, =1, =1.0.0-rc, =1.6, =0.85, =0.85, =0.85, =0.85, =0.89.6 and more Source cves: CVE-2016-6652 Source advisory: OSV:GHSA-XR4V-28RM-PVGW...

Spring Data JPA Blind SQL Injection Vulnerability

PoC for blind SQL injection bug found in Solita Webhack 2016. Founders: Niklas Särökaari, Joona Immonen Analysis: Arto Santala, Niklas Särökaari, Joona Immonen, Antti Virtanen, Michael Holopainen PoC: Antti Ahola, Antti Virtanen CVE: https://pivotal.io/security/cve-2016-6652 This has been fixed i...

CVE-2016-6652

The CVE-2016-6652 vulnerability affects Spring Data JPA prior to 1.9.6 (Gosling SR6) and 1.10.x prior to 1.10.4 (Hopper SR4). When using a repository method that defines a String query with @Query, an attacker can execute arbitrary JPQL commands through a sort parameter (via QueryUtils.applySorti...