216 matches found
spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal
Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=4771286409936896 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...
SUSE CVE-2022-22963
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...
spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal
Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=6703016755724288 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...
Nepxion 安全漏洞
Nepxion Discovery is an enhanced middleware for service registration discovery for Spring Cloud. Nepxion Discovery 6.16.2 and earlier versions are vulnerable to a remote code execution vulnerability that stems from a lack of validation of input data in Discovery-commons and is susceptible to SpEL...
PT-2022-16005 · Nepxion · Nepxion Discovery
Name of the Vulnerable Software and Affected Versions: Nepxion Discovery affected versions not specified Description: The issue is related to SpEL Injection in discovery-commons, where the DiscoveryExpressionResolver’s eval method evaluates expressions with a StandardEvaluationContext. This allow...
VulnCheck KEV: CVE-2022-22963
When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...
Expression Language Injection
Expression Language EL has been defined as part of the Java Server Pages Standard Tag Library JSTL in order to offer developers a simple way to output data from an object model. Starting from the JSP 2.0 specification, Expression Language has been made available within JSP pages, but it is also...
spring-expression: Denial of service via specially crafted SpEL expression
A flaw was found in the Spring Framework. This flaw allows an attacker to craft a special Spring Expression, causing a denial of service...
spring-expression: Denial of service via specially crafted SpEL expression
A flaw was found in the Spring Framework. This flaw allows an attacker to craft a special Spring Expression, causing a denial of service...
Moderate: Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
Updated ovirt-engine packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...
Exploit for Expression Language Injection in Vmware Spring_Data_Mongodb
Springcve-2022-22980 spring data mongodb remote code executio...
spring-expression: Denial of service via specially crafted SpEL expression
A flaw was found in the Spring Framework. This flaw allows an attacker to craft a special Spring Expression, causing a denial of service...
Important: Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update
A minor version update from 7.10 to 7.11 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...
GHSA-W24X-87MR-4R23 SpEL Injection in Spring Data MongoDB
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...
CVE-2022-22980
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...
Spring Data MongoDB 安全漏洞
Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. A security vulnerability exists in Spring Data MongoDB that stems from vulnerability to SpEL injection when using @Query or...
Denial Of Service (DoS)
Spring Expression is vulnerable to denial of service. The vulnerability exists due to the creation of large array in a SpEL and sending meaningless error messages to the user which allows an attacker to send crafted SpEL expressions that leads to an out ouf bound error causing an application cras...
BSA-2022-1768
Security Advisory ID : BSA-2022-1768 Component : Spring Cloud Revision : 1.0 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in...
DEBIAN-CVE-2022-22950
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition...
CVE-2022-22950
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition...