PT-2016-7022

Name of the Vulnerable Software and Affected Versions Pivotal Spring Data JPA versions prior to 1.9.6 Gosling SR6 Pivotal Spring Data JPA versions 1.10.x prior to 1.10.4 Hopper SR4 Description The issue allows attackers to execute arbitrary JPQL commands via a sort instance with a function call,...

CVE-2016-6652: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 Gosling SR6 and 1.10.x before 1.10.4 Hopper SR4, when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call...