bd.ac.seu.erp:model (0.0.2), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.5.0, <=3.6.0) +582 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=2.0.0.release, <=2.0.14.release)

org.springframework.data:spring-data-jpa MAVEN version =2.0.0.release, =3.5.0, =3.5.0, =3.5.0, =0.9.1-rc1, =3.0.0.release, =3.0.1.release - cn.bjdd301:core-mvc 1.0.0 - cn.com.zhaoweiping:alpha-framework 2.0.0.release - cn.jbone:jbone-common 1.0.0 - cn.jbone:jbone-errors 1.0.0 -...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1129 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=1.0.1.release, <=1.11.21.release)

org.springframework.data:spring-data-jpa MAVEN version =1.0.1.release, =1.0.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2019-3802 Source advisory:...

ai.hyacinth.framework:core-service-jpa-support (0.5.0), ai.hyacinth.framework:core-service-trigger-server (0.5.0) +512 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=2.1.0.release, <=2.1.7.release)

org.springframework.data:spring-data-jpa MAVEN version =2.1.0.release, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =3.8.0 - ch.puzzle:libpuzzle-demo-spring-boot-rest 0.1.0-rc1 and more Source cves: CVE-2019-3802 Source advisory: GHSA-XGGX-FX6W-V7CH...

GHSA-XGGX-FX6W-V7CH Improper Neutralization of Wildcards or Matching Symbols

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

ai.hyacinth.framework:core-service-jpa-support (0.5.0), ai.hyacinth.framework:core-service-trigger-server (0.5.0) +974 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=2.0.0.release, <=2.1.7.release)

org.springframework.data:spring-data-jpa MAVEN version =2.0.0.release, =3.5.0, =3.6.0, =3.5.0, =3.5.0, =3.8.0 and more Source cves: CVE-2019-3802 Source advisory: OSV:GHSA-XGGX-FX6W-V7CH...

CVE-2019-3802

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

Design/Logic Flaw

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802

CVE-2019-3802 affects Spring Data JPA up to versions 2.1.6, 2.0.14, and 1.11.20. Affected component is ExampleMatcher using StringMatcher.STARTING, StringMatcher.ENDING, or StringMatcher.CONTAINING, where crafted example values could return more results than intended. Multiple connected sources c...

CVE-2019-3802 Additional information exposure with Spring Data JPA example matcher

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

PT-2019-16730

Name of the Vulnerable Software and Affected Versions Spring Data JPA versions prior to 2.1.7 Spring Data JPA versions 2.0.x up to and including 2.0.14 Spring Data JPA versions 1.11.x up to and including 1.11.20 Description The issue affects the ExampleMatcher in Spring Data JPA, where using...

CVE-2019-3802: Improper Neutralization of Wildcards or Matching Symbols

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

Information Disclosure

spring-data-jpa is vulnerable to information disclosure. A lack of validation and sanitization of wildcard characters when using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING allows a user to retrieve more results than expect...

ai.hyacinth.framework:core-service-jpa-support (0.5.0), ai.hyacinth.framework:core-service-trigger-server (0.5.0) +426 more potentially affected by CVE-2019-3797 via org.springframework.data:spring-data-jpa (>=2.1.0.release, <=2.1.5.release)

org.springframework.data:spring-data-jpa MAVEN version =2.1.0.release, =1.0.0, =0.1.32, =1.0, =1.3 - cn.geminis:geminis-data-jpa 1.0 - cn.jbone:jbone-sso-client 1.0.0 - cn.jbone:jbone-system 1.0.0 and more Source cves: CVE-2019-3797 Source advisory: GHSA-JGMR-WRWX-MGFJ...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1125 more potentially affected by CVE-2019-3797 via org.springframework.data:spring-data-jpa (>=1.0.1.release, <=1.11.18.release)

org.springframework.data:spring-data-jpa MAVEN version =1.0.1.release, =1.0.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2019-3797 Source advisory:...

GHSA-JGMR-WRWX-MGFJ Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE...

bd.ac.seu.erp:model (0.0.2), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.5.0, <=3.6.0) +574 more potentially affected by CVE-2019-3797 via org.springframework.data:spring-data-jpa (>=2.0.0.release, <=2.0.13.release)

org.springframework.data:spring-data-jpa MAVEN version =2.0.0.release, =3.5.0, =3.5.0, =3.5.0, =0.9.1-rc1, =3.0.0.release, =3.0.1.release - cn.bjdd301:core-mvc 1.0.0 - cn.com.zhaoweiping:alpha-framework 2.0.0.release - cn.jbone:jbone-common 1.0.0 - cn.jbone:jbone-errors 1.0.0 -...

bd.ac.seu.erp:model (0.0.2), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.5.0, <=3.6.0) +574 more potentially affected by CVE-2019-3797 via org.springframework.data:spring-data-jpa (>=2.0.0.release, <=2.0.13.release)

org.springframework.data:spring-data-jpa MAVEN version =2.0.0.release, =3.5.0, =3.5.0, =3.5.0, =0.9.1-rc1, =3.0.0.release, =3.0.1.release - cn.bjdd301:core-mvc 1.0.0 - cn.com.zhaoweiping:alpha-framework 2.0.0.release - cn.jbone:jbone-common 1.0.0 - cn.jbone:jbone-errors 1.0.0 -...

ai.hyacinth.framework:core-service-jpa-support (0.5.0), ai.hyacinth.framework:core-service-trigger-server (0.5.0) +426 more potentially affected by CVE-2019-3797 via org.springframework.data:spring-data-jpa (>=2.1.0.release, <=2.1.5.release)

org.springframework.data:spring-data-jpa MAVEN version =2.1.0.release, =1.0.0, =0.1.32, =1.0, =1.3 - cn.geminis:geminis-data-jpa 1.0 - cn.jbone:jbone-sso-client 1.0.0 - cn.jbone:jbone-system 1.0.0 and more Source cves: CVE-2019-3797 Source advisory: OSV:GHSA-JGMR-WRWX-MGFJ...