27 matches found
CVE-2021-22044
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level @RequestMappingannotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to @RequestMapping-annotated interface methods...
EUVD-2022-4750
Malicious code in bioql PyPI...
feign:BodyTemplateFuzzer: Security exception in java.base/java.util.regex.Pattern$GroupTail.match
Project: https://github.com/openfeign/feign.git Detailed Report: https://oss-fuzz.com/testcase?key=5606160910843904 Project: feign Fuzzing Engine: libFuzzer Fuzz Target: BodyTemplateFuzzer Job Type: libfuzzerasanfeign Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
CVE-2024-49203
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...
CVE-2024-49203
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...
CVE-2024-49203
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...
CVE-2024-49203: Undefined Security Weakness
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction...
PT-2024-33345
Name of the Vulnerable Software and Affected Versions Querydsl version 5.1.0 OpenFeign Querydsl version 6.8 Description The issue allows SQL/HQL injection in the orderBy clause of JPAQuery. This is possible when untrusted input is directly used in query construction. Note that the Querydsl...
This Week in Spring - August 23rd, 2022
Hi, Spring fans! Welcome to another installment of This Week in Spring! Weve got a ton to cover, so lets dive right into it! A Bootiful Podcast: Flowable founder Joram Barrez on a Bootiful Podcast on workflow, business process management, and more Building IoT Applications Using Fauna and Spring...
This Week in Spring - August 1st, 2022
Aloha, Spring fans! Welcome to another installment of This Week in Spring! Im still on vacation on the beautiful island of Maui, Hawaii, but I wanted to say hello "aloha!" and share this weeks latest roundup of all thats good and glorious in the wide and wonderful world of Springdom. Funny thing,...
ai.hyacinth.framework:core-service-api-support (0.5.24), ai.hyacinth.framework:core-service-trigger-server (0.5.24) +778 more potentially affected by CVE-2021-22044 via org.springframework.cloud:spring-cloud-openfeign-core (>=2.2.0.release, <=2.2.9.release)
org.springframework.cloud:spring-cloud-openfeign-core MAVEN version =2.2.0.release, =2.1.11-rc2, =2.1.11-rc2, =2.1.11-rc2, =2.1.11-rc2, =2.3.0.release, =0.5.1, =0.5.1, =0.5.1, =0.5.1, =0.8.0 - cc.cc4414:cc-spring-generator 0.8.0 and more Source cves: CVE-2021-22044 Source advisory:...
ai.hyacinth.framework:core-service-api-support (0.5.24), ai.hyacinth.framework:core-service-trigger-server (0.5.24) +778 more potentially affected by CVE-2021-22044 via org.springframework.cloud:spring-cloud-openfeign-core (>=2.2.0.release, <=2.2.9.release)
org.springframework.cloud:spring-cloud-openfeign-core MAVEN version =2.2.0.release, =2.1.11-rc2, =2.1.11-rc2, =2.1.11-rc2, =2.1.11-rc2, =2.3.0.release, =0.5.1, =0.5.1, =0.5.1, =0.5.1, =0.8.0 - cc.cc4414:cc-spring-generator 0.8.0 and more Source cves: CVE-2021-22044 Source advisory:...
cc.vihackerframework:vihacker-cloud-starter (>=1.0.4.r, <=1.0.6.r), cc.vihackerframework:vihacker-feign-starter (>=1.0.4.r, <=1.0.6.r) +334 more potentially affected by CVE-2021-22044 via org.springframework.cloud:spring-cloud-openfeign-core (>=3.0.0, <=3.0.4)
org.springframework.cloud:spring-cloud-openfeign-core MAVEN version =3.0.0, =1.0.4.r, =1.0.4.r, =1.2.12, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.1.0 and more Source cves: CVE-2021-22044 Source advisory: GHSA-PF94-6V2V-CM3J...
cc.vihackerframework:vihacker-cloud-starter (>=1.0.4.r, <=1.0.6.r), cc.vihackerframework:vihacker-feign-starter (>=1.0.4.r, <=1.0.6.r) +334 more potentially affected by CVE-2021-22044 via org.springframework.cloud:spring-cloud-openfeign-core (>=3.0.0, <=3.0.4)
org.springframework.cloud:spring-cloud-openfeign-core MAVEN version =3.0.0, =1.0.4.r, =1.0.4.r, =1.2.12, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.1.0 and more Source cves: CVE-2021-22044 Source advisory: OSV:GHSA-PF94-6V2V-CM3J...
GHSA-PF94-6V2V-CM3J Exposure of Resource to Wrong Sphere in Spring Cloud OpenFeign
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level @RequestMappingannotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to @RequestMapping-annotated interface methods...
Exposure of Resource to Wrong Sphere in Spring Cloud OpenFeign
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level @RequestMappingannotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to @RequestMapping-annotated interface methods...
CVE-2021-22044
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level @RequestMappingannotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to @RequestMapping-annotated interface methods...
CVE-2021-22044
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level @RequestMappingannotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to @RequestMapping-annotated interface methods...
CVE-2021-22044
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level @RequestMappingannotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to @RequestMapping-annotated interface methods...
Design/Logic Flaw
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level @RequestMappingannotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to @RequestMapping-annotated interface methods...