aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +31303 more potentially affected by CVE-2020-14060 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-14060 Source advisory:...

XSS Vulnerability in My-Blog-layui

My-Blog-layui by SpringBoot + Layui + Mybatis + Thymeleaf and other technologies to achieve the Java blog system . My-Blog-layui has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

GitHub Security Lab: CodeQL query to detect open Spring Boot actuator endpoints

This bug was reported directly to GitHub Security Lab...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.13 security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.6 security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Guardedbox - Online Client-Side Manager For Secure Storage And Secrets Sharing

GuardedBox is an open-source online client-side manager for secure storage and secrets sharing. It allows users to upload secrets to a centralized server and retrieve them at anytime and from anywhere. It also allows users to share their secrets with other users, individually or via groups. Secre...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-9484 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-9484 Source advisory: GHSA-344F-F5VG-2JFJ...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-9484 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-9484 Source advisory: OSV:GHSA-344F-F5VG-2JFJ...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-9484 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-9484 Source advisory: MEND:CVE-2020-9484...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.12), ai.grakn:grakn (>=0.17.0, <=0.18.0) +14696 more potentially affected by CVE-2020-9547 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0, <=2.8.11.5)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.1.8, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.18.0 and more Source cves: CVE-2020-9547 Source advisory: GHSA-Q93H-JC49-78GG...

Spring Boot < 1.2.8 / 1.3.0 Whitelabel Error Page Remote Code Execution

Pivotal Spring Boot is a Java framework designed to help developers create minimal Spring based applications. Spring applications provide the Spring Expression Language SpEL which is a powerful expression language for querying and manipulating an object graph at runtime. Spring Boot versions belo...

LY Corporation: Spring Actuator endpoints publicly available and broken authentication

Due to insufficient access control, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. @kazan71p identified two highly sensitive applications leaking information through these endpoints. The LINE Security team shutdown the secondary endpoints just as it was discovere...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.12), ai.grakn:grakn (>=0.17.0, <=0.18.0) +14694 more potentially affected by CVE-2019-20330 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0, <=2.8.11.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.1.8, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.18.0 and more Source cves: CVE-2019-20330 Source advisory: OSV:GHSA-GWW7-P5W4-WRFV...

Spring Boot Installed

Binary data pivotalsoftwarespringbootinstalled.nbin...

Stripo Inc: Open memory dump method leaking customer information ,secret keys , password , source code & admin accounts

Summary: Stripo uses Spring boot for the backend API development , and misconfigured the application to open actuator APIs to the public. This issue is found in 3 domains , don't know if I need to publish 3 reports for that, or just one report , but the domains are :...

com.github.pukkaone:odata-elasticsearch2-spring-boot-starter (1.4.0-0), com.github.pukkaone:odata-web-spring-boot-starter (1.4.0-0) +27 more potentially affected by CVE-2019-17554 via org.apache.olingo:odata-server-core (>=4.0.0, <=4.6.0)

org.apache.olingo:odata-server-core MAVEN version =4.0.0, =1.1.0-release, =1.0.0-release, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.2.9 and more Source cves: CVE-2019-17554 Source advisory: MEND:CVE-2019-17554...

com.github.dkubiak:goldfish-collector-maven (1.0), com.github.dkubiak:goldfish-server (1.0) +3 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.1.4.final)

io.undertow:undertow-core MAVEN version 1.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.dkubiak:goldfish-collector-maven 1.0 - com.github.dkubiak:goldfish-server 1.0 -...

io.undertow:undertow-servlet (1.1.7.final), io.undertow:undertow-websockets-jsr (1.1.7.final) +1 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.1.7.final)

io.undertow:undertow-core MAVEN version 1.1.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.7.final - io.undertow:undertow-websockets-jsr 1.1.7.final -...

io.undertow:undertow-servlet (1.3.28.final), io.undertow:undertow-websockets-jsr (1.3.28.final) +1 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.3.28.final)

io.undertow:undertow-core MAVEN version 1.3.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.28.final - io.undertow:undertow-websockets-jsr 1.3.28.final -...