Spring Data REST Installed

Binary data pivotalsoftwarespringdatarestinstalled.nbin...

CVE-2018-1273

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

CVE-2019-3802

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

Improper Neutralization of Wildcards or Matching Symbols

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

GHSA-XGGX-FX6W-V7CH Improper Neutralization of Wildcards or Matching Symbols

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1129 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=1.0.1.release, <=1.11.21.release)

org.springframework.data:spring-data-jpa MAVEN version =1.0.1.release, =1.0.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2019-3802 Source advisory:...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1129 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=1.0.1.release, <=1.11.21.release)

org.springframework.data:spring-data-jpa MAVEN version =1.0.1.release, =1.0.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2019-3802 Source advisory:...

bd.ac.seu.erp:model (0.0.2), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.5.0, <=3.6.0) +582 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=2.0.0.release, <=2.0.14.release)

org.springframework.data:spring-data-jpa MAVEN version =2.0.0.release, =3.5.0, =3.5.0, =3.5.0, =0.9.1-rc1, =3.0.0.release, =3.0.1.release - cn.bjdd301:core-mvc 1.0.0 - cn.com.zhaoweiping:alpha-framework 2.0.0.release - cn.jbone:jbone-common 1.0.0 - cn.jbone:jbone-errors 1.0.0 -...

ai.hyacinth.framework:core-service-jpa-support (0.5.0), ai.hyacinth.framework:core-service-trigger-server (0.5.0) +974 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=2.0.0.release, <=2.1.7.release)

org.springframework.data:spring-data-jpa MAVEN version =2.0.0.release, =3.5.0, =3.6.0, =3.5.0, =3.5.0, =3.8.0 and more Source cves: CVE-2019-3802 Source advisory: OSV:GHSA-XGGX-FX6W-V7CH...

ai.hyacinth.framework:core-service-jpa-support (0.5.0), ai.hyacinth.framework:core-service-trigger-server (0.5.0) +512 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=2.1.0.release, <=2.1.7.release)

org.springframework.data:spring-data-jpa MAVEN version =2.1.0.release, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =3.8.0 - ch.puzzle:libpuzzle-demo-spring-boot-rest 0.1.0-rc1 and more Source cves: CVE-2019-3802 Source advisory: GHSA-XGGX-FX6W-V7CH...

Design/Logic Flaw

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802 Additional information exposure with Spring Data JPA example matcher

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802

CVE-2019-3802 affects Spring Data JPA up to versions 2.1.6, 2.0.14, and 1.11.20. Affected component is ExampleMatcher using StringMatcher.STARTING, StringMatcher.ENDING, or StringMatcher.CONTAINING, where crafted example values could return more results than intended. Multiple connected sources c...

CVE-2019-3802

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802: Improper Neutralization of Wildcards or Matching Symbols

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

PT-2019-16730

Name of the Vulnerable Software and Affected Versions Spring Data JPA versions prior to 2.1.7 Spring Data JPA versions 2.0.x up to and including 2.0.14 Spring Data JPA versions 1.11.x up to and including 1.11.20 Description The issue affects the ExampleMatcher in Spring Data JPA, where using...

VulnCheck KEV: CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

Information Disclosure

spring-data-jpa is vulnerable to information disclosure. A lack of validation and sanitization of wildcard characters when using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING allows a user to retrieve more results than expect...

GHSA-JGMR-WRWX-MGFJ Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE...