EUVD-2026-67171

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

CVE-2026-59282

CVE-2026-59282 affects Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object. The root cause is unbounded list growth triggered during data binding, leading to a Denial of Service . Spring rates this as MEDIUM severi...

CVE-2026-59281

Spring Framework versions from 5.2.25.RELEASE through 7.0.8 are vulnerable to a reflected cross-site scripting (XSS) flaw in Spring MVC and WebFlux applications. The root cause involves data-binding Errors instances with HTML escaping enabled: when field errors are rendered using the no-argument ...

EUVD-2026-67170

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

cve-2022-22965

Exemplo mínimo de CVE-2022-22965 No momento em que este texto foi escrito, a vinculação de parâmetros de requisição do spring-web WebDataBinder, por padrão, permite acessar o método getClass do objeto. Este é um detalhe de implementação interno específico da jvm na minha opinião, não deveria ser...

spring4shell-local-verification-lab

Progetto di verifica delle condizioni di impatto locale, riparazione e ripetizione del test per Spring4Shell Introduzione al progetto Questo progetto è utilizzato per apprendere e verificare Spring Framework CVE-2022-22965, noto anche come vulnerabilità Spring4Shell, comprese le condizioni di...

CVE-2022-22965

Spring4ShellCVE-2022-22965 Spring Framework RCE tramite Data Binding su JDK 9+ / spring4shell / CVE-2022-22965 Spring4ShellCVE-2022-22965 Demo dell'exploit https://user-images.githubusercontent.com/57348147/161458377-44ab2f76-f947-4599-aa0a-92cbaac819f8.mp4 Compilazione root@kitploit: docker pull...

CVE-2018-1273

CVE-2018-1273 Umgebung für CVE-2018-1273 CVE-2018-1273: RCE mit Spring Data Commons https://pivotal.io/security/cve-2018-1273 Anwendung https://github.com/spring-projects/spring-data-examples/tree/master/web/example Erstellen root@kitploit: $ docker build -t cve-2018-1273 . Ausführen root@kitploi...

nmap-spring4shell

Nmap-spring4shell Log4shell-nmap è uno script NSE per rilevare vulnerabilità RCE di Spring4Shell CVE-2022-22965 nei servizi HTTP. Lo script inietta il payload corretto nell'applicazione e poi esegue il seguente comando sull'endpoint specificato. Vulnerabilità Vedi qui. Utilizzo root@kitploit:...

spring-RCE-CVE-2022-22965

Einführung in die Schwachstelle Kürzlich wurde von Spring eine schwerwiegende CVE-Schwachstelle veröffentlicht. Die CVE-Informationen besagen: „A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requir...

CVE-2026-32635-Angular-XSS-Mitigation-

CVE-2026-32635: Angular i18n Attribute XSS - Mitigation & Detection PoC 📌 Allgemeine Beschreibung Dieses Repository enthält eine pädagogische Demonstration der Abschwächung und Erkennung für CVE-2026-32635 , eine Cross-Site-Scripting XSS -Schwachstelle in Angular, die internationalisierte Attribu...

Spring-CVE

Spring CVE Questo include CVE-2022-22963, una vulnerabilità di accesso alle risorse tramite espressioni SpEL / Expression Resource Access di Spring, nonché CVE-2022-22965, l'RCE di spring-webmvc/spring-webflux denominata "SpringShell". CVE-2022-22963 Nelle versioni 3.1.6, 3.2.2 e versioni...

CVE-2022-22965_Spring4Shell

CVE-2022-22965Spring4Shell CVE-2022-22965（Spring4Shell，SpringShell）是Spring框架中的一个漏洞，它利用数据绑定功能将HTTP请求中存储的数据绑定到应用程序使用的某些对象。该漏洞存在于getCachedIntrospectionResults方法中，攻击者可以通过HTTP请求传递类名来未经授权访问此类对象。当使用特殊对象类时，会导致数据泄露和远程代码执行的风险。此漏洞类似于早已关闭的CVE-2010-1622，该漏洞通过添加类名检查作为修复，以确保名称不匹配classLoader或protectionDomain。 评分...

CVE-2022-22965

CVE-2022-22965 alias "Spring4Shell" Vulnérabilité RCE dans Spring Framework via Data Binding sur JDK 9+ L'objectif est de centraliser le maximum d'informations publiquement connues à ce jour sur la vulnérabilité et de savoir quelles actions entreprendre dans ce cas. Mon application est-elle...

CVE-2022-22965

🚨 CVE-2022-22965 — "Spring4Shell" Kritische Remote Code Execution RCE Schwachstelle Öffentlich bekannt gegeben: 31. März 2022 📖 Inhaltsverzeichnis Übersicht Betroffene Komponenten Technische Ursache Ausnutzungsbedingungen Auswirkungen Schweregrad & CVSS Absicherung & Patches Zeitplan Vergleich mi...

CVE-2022-22965

Vulnerabilità Spring4Shell - CVE-2022-22965 📕 Introduzione La vulnerabilità spring4shell è stata chiamata così a causa di 2 vulnerabilità trovate e ampiamente sfruttate dagli attaccanti all'inizio del 2022. Una di queste vulnerabilità si trova nel componente del framework chiamato "Spring Cloud...

Spring4Shell-PoC-exploit

Spring4Shell - PoC CVE - 2022 - 22965 Versões afetadas : Versões do Spring Framework 5.3.0 a 5.3.17, 5.2.0 a 5.2.19 e versões mais antigas Java JDK 9 Versões do Apache Tomcat abaixo de 10..0.20, 9.0.62 e 8.5.78 Aplicações que são empacotadas como um WAR tradicional com dependência spring-webmvc o...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Jackson Data Binding, Jackson Core, Postgresql, Scram Client, Apache MINA SSHD, Jansi Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

Security Bulletin: Vulnerabilities in jackson-databind may affect IBM APM Linux KVM Agent for Virtual Environments.

Summary There are vulnerabilities in the jackson-databind jar used by IBM APM Linux KVM Agent for Virtual Environments. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From...

CVE-2026-59642

CVE-2026-59642 affects Bouncy Castle for Java: CMS AuthenticatedData content is not bound to MAC when authAttrs are present. Affected versions include: Java Bouncy Castle before 1.85; Java LTS before 2.73.12; Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.x), 2.0.12 (2.0.x), and 2.1.12 (2.1.x)...