193 matches found
cve-2024-38819
CVE-2024-38819 01. Обзор File-Traversal и Webflux 1 Обзор File-Traversal и WebFlux Уязвимость File-Traversal обход пути, Path Traversal позволяет злоумышленнику обходить разрешения файловой системы веб-приложения и получать доступ к произвольным файлам; она классифицируется как CWE-22 и является...
Spring-CVE
Spring CVE Сюда входят CVE-2022-22963, уязвимость Spring SpEL / Expression Resource Access, а также CVE-2022-22965, RCE в spring-webmvc/spring-webflux, получившая название «SpringShell». CVE-2022-22963 В версиях Spring Cloud Function 3.1.6, 3.2.2 и более старых неподдерживаемых версиях при...
spring-RCE-CVE-2022-22965
Описание уязвимости Недавно в Spring была обнаружена серьезная уязвимость CVE. Согласно информации CVE, "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as ...
PoC-CVE-2022-22965-Spring4Shell
PoC — CVE-2022-22965 Spring4Shell 면책 조항: 이 저장소는 교육 및 연구 목적으로만 제공됩니다. 모든 익스플로잇 스크립트는 반드시 자신이 소유하거나 명시적인 서면 승인을 받은 시스템에만 사용해야 합니다. 저자는 이 자료로 인한 오용 또는 손해에 대해 책임지지 않습니다. CVE-2022-22965에 대한 연구 및 개념 증명PoC 자료입니다. 이 취약점은 2022년 4월에 공개된 Spring Framework의 치명적인 원격 코드 실행RCE 취약점입니다. 취약점 개요 Spring4Shell 은 다음 조건...
CVE-2026-47883
CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC 이 저장소는 Spring 공식 보안 권고문으로 공개된 CVE-2026-47883의 최소 재현 PoC입니다. 공식 권고문: https://spring.io/security/cve-2026-47883/ 공식 제목: Spring Framework Open Redirect in UrlHandlerFilter 심각도: Medium CVSS v3.1: 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A...
cve-2024-38821
cve-2024-38821 Analisi: https://www.deep-kondah.com/spring-webflux-static-resource-access-vulnerability-cve-2024-38821-explained/...
CVE-2026-47890
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
CVE-2026-47885
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...
CVE-2026-47883
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
CVE-2026-47885
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...
CVE-2026-47883
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
CVE-2026-47890
Spring Framework versions 7.0.0–7.0.8 and 6.2.0–6.2.19 are affected by a stream corruption issue when Server-Sent Events (SSE) are used with view fragments in Spring MVC and WebFlux applications. The NVD-assigned CVSS 3.1 score is 9.8 (Critical) , while the vendor (Spring) classifies it as LOW se...
CVE-2026-47885 Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...
CVE-2026-47885
This vulnerability affects the PartEventHttpMessageReader in Spring WebFlux , which fails to enforce the maxPartSize limit when maxInMemorySize is set to -1, potentially allowing oversized multipart data to be processed without the intended size constraint. Affected versions are Spring Framework ...
CVE-2026-47883 Spring Framework Open Redirect in UrlHandlerFilter
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
EUVD-2026-66851
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
CVE-2026-47883
Spring Framework 's UrlHandlerFilter is vulnerable to an open redirect (CWE-601) when configured with very broadly matching patterns, potentially generating headers that point to external origins. The issue affects both Spring MVC and Spring WebFlux filter variants in Spring Framework 6.2.0–6.2.1...
CVE-2026-41847
A flaw was found in Spring WebFlux applications. This vulnerability allows for a security bypass when using the Kotlin Router DSL. An attacker could exploit this to bypass security restrictions, potentially leading to unauthorized access. Mitigation This vulnerability only applies when using Kotl...
CVE-2026-41840
A flaw was found in Spring WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted multipart requests, leading to a Denial of Service DoS condition. This could make the application unavailable to legitimate users. Mitigation No specific mitigation is...
