CVE-2019-9186: Exposure of Resource to Wrong Sphere

In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces instead of listening on only the localhost interface. This issue has bee...

io.undertow:undertow-servlet (1.1.7.final), io.undertow:undertow-websockets-jsr (1.1.7.final) +1 more potentially affected by CVE-2019-3888 via io.undertow:undertow-core (1.1.7.final)

io.undertow:undertow-core MAVEN version 1.1.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.7.final - io.undertow:undertow-websockets-jsr 1.1.7.final -...

com.pep1:pep1-commons-rest (0.6), io.syndesis:http-pull-push-example (>=0.4.2, <=0.4.5) +5 more potentially affected by CVE-2019-3888 via io.undertow:undertow-core (1.3.27.final)

io.undertow:undertow-core MAVEN version 1.3.27.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.pep1:pep1-commons-rest 0.6 - io.syndesis:http-pull-push-example =0.4.2, =0.4.2, =0.4.2, =0.4.5 -...

io.undertow:undertow-servlet (1.3.28.final), io.undertow:undertow-websockets-jsr (1.3.28.final) +1 more potentially affected by CVE-2019-3888 via io.undertow:undertow-core (1.3.28.final)

io.undertow:undertow-core MAVEN version 1.3.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.28.final - io.undertow:undertow-websockets-jsr 1.3.28.final -...

io.undertow:undertow-servlet (1.1.9.final), io.undertow:undertow-websockets-jsr (1.1.9.final) +1 more potentially affected by CVE-2019-3888 via io.undertow:undertow-core (1.1.9.final)

io.undertow:undertow-core MAVEN version 1.1.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.9.final - io.undertow:undertow-websockets-jsr 1.1.9.final -...

VulnCheck KEV: CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

xss vulnerability in jeeweb frontend

JeeWeb is an agile development system based on SpringBoot 2+Spring+Mybatis+Hibernate An xss vulnerability exists in the frontend of jeeweb, which can be exploited by an attacker to obtain an administrator cookie...

File Upload Vulnerability in Geek-Framework

Geek-Framework is built on the basis of SpringBoot, a Java foundation development framework . Geek-Framework has a file upload vulnerability that can be exploited by an attacker to gain control of a web server...

Spring Boot Actuator Command Execution Vulnerability

Actuators are one of the four main features proposed in Spring Boot to simplify Spring development. A command execution vulnerability exists in Spring Boot Actuator, which can be exploited by an attacker to execute arbitrary commands by constructing a malicious request...

Spring Boot Actuator Module Command Execution Vulnerability

Spring Boot Acuatorr can help you monitor and manage your Spring Boot applications, such as health checks, auditing, statistics and HTTP tracing. A command execution vulnerability exists in the Spring Boot Actuator module. The vulnerability is realized by using JNDI through Spring Boot Actuator's...

org.apache.camel:camel-spring-batch (>=2.13.0, <=2.13.4), org.springframework.batch:spring-batch-test (2.2.5.release) +1 more potentially affected by CVE-2019-3774 via org.springframework.batch:spring-batch-core (2.2.5.release)

org.springframework.batch:spring-batch-core MAVEN version 2.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.batch:spring-batch-core and may be impacted: - org.apache.camel:camel-spring-batch =2.13.0, =1.0.0.release,...

de.codecentric:spring-boot-starter-batch-web (1.0.0.release), org.springframework.batch:spring-batch-test (2.2.6.release) +1 more potentially affected by CVE-2019-3774 via org.springframework.batch:spring-batch-core (2.2.6.release)

org.springframework.batch:spring-batch-core MAVEN version 2.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.batch:spring-batch-core and may be impacted: - de.codecentric:spring-boot-starter-batch-web 1.0.0.release -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.12), ai.grakn:grakn (>=0.17.0, <=0.18.0) +14285 more potentially affected by CVE-2018-14720 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0, <=2.8.11.2)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.1.8, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.18.0 and more Source cves: CVE-2018-14720 Source advisory: GHSA-X2W5-5M2G-7H5M...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.12), ai.grakn:grakn (>=0.17.0, <=0.18.0) +14285 more potentially affected by CVE-2018-19361 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0, <=2.8.11.2)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.1.8, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.18.0 and more Source cves: CVE-2018-19361 Source advisory: GHSA-MX9V-GMH4-MGQW...

com.microsoft.azure:azure-active-directory-b2c-spring-boot-starter (>=2.1.4.m1, <=2.1.6.m2), com.sap.cloud.security.xsuaa:spring-xsuaa (>=1.1.0.rc1, <=2.1.0) +4 more potentially affected by CVE-2018-15801 via org.springframework.security:spring-security-oauth2-jose (5.1.1.release)

org.springframework.security:spring-security-oauth2-jose MAVEN version 5.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: -...

Arbitrary Password Reset Vulnerability in Ruoyi Management System

Ruoyi management system is a SpringBoot2.0 based on the use of Spring, MyBatis, Shiro rights management system . Ruoyi Management System has an arbitrary password reset vulnerability that can be exploited by an attacker to reset any user's password...

CVE-2018-15756

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

org.grails:grails-dependencies (2.4.0.rc1), org.grails:grails-encoder (2.4.0.rc1) +33 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.4.0.rc1)

org.grails:grails-core MAVEN version 2.4.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.0.rc1 - org.grails:grails-encoder 2.4.0.rc1 -...

Denial of service

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

CVE-2018-15756

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...