CVE-2022-22963

Уязвимость Spring Cloud Function CVE-2022-22963 Уязвимое приложение к CVE-2022-22963 Демонстрация эксплойта CVE-2022-22963 https://user-images.githubusercontent.com/57348147/161266562-51d025f0-54d4-488f-ac50-2317e29bfbdf.mp4 Сборка root@kitploit: docker pull me2nuk/cves:2022-22963 docker run -it ...

CVE-2022-22963

CVE-2022-22963 Automatisation éducative de preuve de concept pour CVE-2022-22963, démontrée dans un environnement de laboratoire Hack The Box autorisé. Aperçu CVE-2022-22963 est une vulnérabilité de Spring Cloud Function impliquant l'en-tête spring.cloud.function.routing-expression. Dans des...

CVE-2022-22947-

CVE-2022-22947 Exécution de commandes par injection d'expression SpEL dans l'API Actuator de Spring Cloud Gateway CVE-2022-22947 - Injection de cheval de mémoire Godzilla Clé par défaut pass base64 Note : le code ne nettoie pas la partie routage, veuillez le faire vous-même. Environnement de test...

CVE-2022-22947-pb-ai

Application de validation de vulnérabilité CVE-2022-22947 Spring Cloud Gateway Il s'agit d'une application Spring Cloud Gateway spécialement conçue pour démontrer et valider la vulnérabilité CVE-2022-22947. Cette application utilise une version vulnérable de Spring Cloud Gateway et permet...

CVE-2022-22980

SpEL RCE Exploit - CVE-2022-22980 Exploit pour l'exécution de code à distance RCE sur Spring Data via une injection SpEL Spring Expression Language. Descriptions Vulnérabilité La boîte expose un endpoint /search qui accepte un paramètre trackingid vulnérable à l'injection SpEL. Cette injection...

CVE-2022-22963

CVE-2022-22963 CVE-2022-22963 PoC Légèrement modifié pour la traduction en anglais et la détection de https://github.com/chaosec2021/Spring-cloud-function-SpEL-RCE/blob/main/SpelRCEPOC.py . Par défaut, whoami est exécuté sur la cible et un fichier vulnerable.txt est créé avec les URL vulnérables...

CVE-2026-41729

CVE-2026-41729: Preuve de Concept d'Injection SpEL par Clé de Map dans JSON Patch pour Spring Data REST Ce dépôt est une Preuve de Concept PoC de reproduction minimale de CVE-2026-41729, divulguée via l'avis de sécurité officiel de Spring. Avis officiel : https://spring.io/security/cve-2026-41729...

CVE-2026-63337 vulnerabilities

Vulnerabilities for packages: zipkin, traccar-fips, conductor, thingsboard, conductor-fips, cassandra-reaper, logstash-fips, logstash, druid, nuxeo, traccar...

SpEL Injection

Spring Data KeyValue / Spring Data Redis is vulnerable to SpEL Injection. The vulnerability is due to unsanitized Sort input being evaluated by SpelPropertyComparator, allowing an attacker to inject and execute malicious SpEL expressions...

Expression Language (SpEL) Injection

Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...

DoS (Denial of Service) org.springframework:spring-expression Dependency in Bamboo Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...

GHSA-J388-8RM5-P97F Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

GHSA-XG2J-3HJ6-PC24 Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

GHSA-5WHC-4Q84-FJ73 Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0...

CVE-2026-41729

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

VMware Spring Data REST 安全漏洞

VMware Spring Data REST is a data interface provided by the American company VMware. It is used to build HTTP resources that drive hypermedia, based on Spring Data repositories. These resources are designed to manage domain models of applications and provide hypermedia-driven services for...

VMware Spring Data KeyValue和VMware Spring Data Redis 安全漏洞

VMware Spring Data KeyValue and VMware Spring Data Redis are both products of the American company VMware. VMware Spring Data KeyValue is a key-value storage data access framework. VMware Spring Data Redis is a Redis data access framework. Both VMware Spring Data KeyValue and VMware Spring Data...