cn.iisme.cloud:iisme-demos-shiro-web (1.0.1), cn.iisme.cloud:iisme-starter-shiro (1.0.1) +69 more potentially affected by CVE-2020-17523 via org.apache.shiro:shiro-spring-boot-starter (>=1.4.0-rc2, <=1.7.0)

org.apache.shiro:shiro-spring-boot-starter MAVEN version =1.4.0-rc2, =1.1.1, =0.0.6, =0.0.6, =2.1.1, =2.0.4-rc1, =2.2.0, =2.2.0, =1.0.0, =1.0.1 and more Source cves: CVE-2020-17523 Source advisory: MEND:CVE-2020-17523...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.3.6 security update

An update is now available for Red Hat support for Spring Boot. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

cn.xphsc.boot:kubernetes-spring-boot-starer (1.0.0-rc), com.bybutter.sisyphus.middleware:sisyphus-grpc-client-kubernetes (>=0.0.6-m0, <=0.0.6-m3) +11 more potentially affected by CVE-2020-8570 via io.kubernetes:client-java (>=9.0.0, <=9.0.1)

io.kubernetes:client-java MAVEN version =9.0.0, =0.0.6-m0, =0.9.8.3, =0.9.8.3, =0.9.8.3, =9.0.0, =9.0.0, =9.0.0, =3.6.17, =5.0.0 Source cves: CVE-2020-8570 Source advisory: GHSA-CGHX-9GCR-R42X...

com.github.fanzezhen.common:common-security (>=0.0.1, <=2.0.3), com.github.fanzezhen:security (>=1.3.3, <=1.3.4.4) +4 more potentially affected by CVE-2021-24122 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m9)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =0.0.1, =1.3.3, =5.22, =10.0.0-m1, =10.0.0-m1, =10.0.0-m9 - org.jboss.arquillian.container:arquillian-tomcat-embedded-10 1.2.0.alpha1 Source cves: CVE-2021-24122 Source advisory: MEND:CVE-2021-24122...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.11 security update

An update is now available for Red Hat support for Spring Boot. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

Directory Traversal

spring-boot-actuator-logview is vulnerable to directory traversal. The vulnerability exists through the base folder parameter exposed in the log file directory through admin HTTP endpoints...

CVE-2021-21234

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this librar...

CVE-2021-21234

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this librar...

Directory traversal

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this librar...

CVE-2021-21234

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this librar...

CVE-2021-21234 Directory Traversal

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this librar...

CVE-2021-21234

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this librar...

CVE-2021-21234

CVE-2021-21234 affects the Spring Boot Actuator Logview library (eu.hinsch:spring-boot-actuator-logview). Before version 0.2.13, there is a directory traversal vulnerability exposed by the actuator logviewer endpoint, where both the filename parameter and the base directory can be manipulated (ba...

Directory Traversal in spring-boot-actuator-logview

Impact The nature of this library is to expose a log file directory via admin spring boot actuator HTTP endpoints. Both the filename to view and a base folder relative to the logging folder root can be specified via request parameters. While the filename parameter was checked to prevent directory...

CVE-2021-21234: Improper Limitation of a Pathname to a Restricted Directory

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this librar...

Lukashinsch Spring Boot Actuator Logview Path Traversal Vulnerability

Lukashinsch Spring Boot Actuator Logview is a codebase by the individual developer Ffay Lukashinsch that provides Spring Boot with the ability to view logs via a web interface. A path traversal vulnerability exists in spring-boot-actuator-logview versions prior to 0.2.13, which stems from the...

PT-2021-14346

Name of the Vulnerable Software and Affected Versions: spring-boot-actuator-logview versions prior to 0.2.13 Description: The issue concerns a directory traversal vulnerability in the spring-boot-actuator-logview library, which exposes a log file directory via admin HTTP endpoints. Both the...

cn.centychen:xxl-job-spring-boot-starter (>=1.0.0-release, <=1.0.1-release), cn.db101:xxl-job-spring-boot-starter (1.1.0) +53 more potentially affected by CVE-2020-29204 via com.xuxueli:xxl-job-core (>=1.8.2, <=2.2.0)

com.xuxueli:xxl-job-core MAVEN version =1.8.2, =1.0.0-release, =0.0.8-release, =0.0.8-release, =1.6.0, =1.0.1, =2.1.1-release, =6.1.0, =0.0.4, =1.5.13, =1.7.1 - com.gitee.zodiacstack:zodiac-xxljob-spring-boot-starter 1.5.16 - com.github.hiwepy:xxljob-spring-boot-starter 1.0.0.release -...

Command Execution Vulnerability in Huaxia ERP (CNVD-2020-70782)

Huaxia ERP based on SpringBoot framework , aspires to provide small and medium-sized enterprises with open source and good ERP software , currently focusing on sales and inventory + financial functions . HUAXIA ERP has a command execution vulnerability. Attackers can use this vulnerability to...

ca.ibodrov.concord:testcontainers-concord (>=0.0.2, <=0.0.20), ca.ibodrov.concord:testcontainers-concord-core (>=0.0.21, <=0.0.41) +87 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (>=9.0.0, <=9.1.2)

com.cronutils:cron-utils MAVEN version =9.0.0, =0.0.2, =0.0.21, =0.0.1, =0.1.2, =0.0.1, =1.2.19, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2020-26238 Source advisory: OSV:GHSA-PFJ3-56HM-JWQ5...