CVE-2021-22096

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries...

CVE-2021-22096

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries...

PT-2021-14849

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.3.0 through 5.3.10 Spring Framework versions 5.2.0 through 5.2.17 Spring Framework older unsupported versions Description The issue allows a user to provide malicious input, causing the insertion of additional log...

CVE-2021-22096: Improper Output Neutralization for Logs

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries...

Vmware Spring Framework security vulnerabilities

Vmware Spring Framework is the United States, Vmware Vmware company's set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. A security vulnerability exists in Vmware Spring Framework that originates from bypassing Spring Framework...

Oracle MySQL Enterprise Monitor (Oct 2021 CPU)

The 8.0.25 versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory. - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL component: Monitoring: General Spring Security. Supported...

Security Bulletin: IBM Security Risk Manager on CP4S is affected by multiple vulnerabilities

Summary IBM Security Risk Manager on CP4S has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2020-5421 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation. By using a...

Security Bulletin: A vulnerability in Spring Framework affects IBM Watson Machine Learning Accelerator

Summary A vulnerability exists in Spring Framework version used by IBM Watson Machine Learning Accelerator. Spring framework upgrade to version 5.2.15 which resolves these vulnerabilities, is available on IBM Fix Central. Vulnerability Details CVEID: CVE-2021-22118 DESCRIPTION: VMware Tanzu Sprin...

Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities

Summary IBM Data Risk Manager has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2021-20227 DESCRIPTION: SQLite is vulnerable to a denial of service, caused by a use-after-free flaw in the SELECT query function in src/select.c. By sending a specially-crafted request, a...

Demo: A Guide to Virtual Machine App Security

Enhance your virtual machine VM application security from vulnerabilities in your Spring Framework Java application by reviewing these guidelines...

Demo: A Guide to Virtual Machine App Security

Enhance your virtual machine VM application security from vulnerabilities in your Spring Framework Java application by reviewing these guidelines...

UReport code injection vulnerability

UReport is a high-performance pure Java reporting engine based on the Spring architecture. The vulnerability stems from a lack of access control to the designer page. An attacker can exploit this vulnerability to execute arbitrary code...

Security Bulletin: IBM Security Guardium is affected by a Spring Framework vulnerability

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2020-5421 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation. By using a specially-crafted jsessionid path...

Security Bulletin: A Privilege Escalation vulnerability in Pivotal Spring Framework affects IBM LKS Administration & Reporting Tool and its Agent

Summary A Privilege Escalation related vulnerability has been found in Pivotal Spring Framework used by IBM LKS Administration & Reporting Tool ART and its Agent. A fix has been published. Vulnerability Details CVEID: CVE-2021-22118 DESCRIPTION: VMware Tanzu Spring Framework could allow a local...

springframework: RFD protection bypass via jsessionid

In Spring Framework, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

WS-2021-0173

In spring-framework, versions v3.0.0.M1 through v3.0.5.RELEASE are vulnerable to Cross-Site Scripting XSS, due to LocaleChangeInterceptor not escaping the Locale value from a user HTTP request...

WS-2021-0174

In spring-framework, versions 4.0.0 to 4.0.1 and 3.0.0 to 3.2.18, are vulnerable against CGLIB memory leak for method injection as a result of mishandled callbacks and non-static classes...

WS-2021-0172

In spring-framework, versions v5.0.0.M1 through v5.0.20.RELEASE are vulnerable to cross-site request forgery CSRF, due to ‘SameSite’ cookie not implemented...

Spring Framework Privilege Escalation

The vulnerability of the Spring Framework software is caused by privilege management errors. Exploiting this vulnerability allows an attacker to read and rewrite any files at will...

CVE-2021-22118

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by recreating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFl...