1429 matches found
PT-2022-2032
Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.2.20 Spring Framework versions prior to 5.3.18 Spring Boot versions prior to 2.5.12 Spring Boot versions prior to 2.6.6 VMware Tanzu Application Service for Virtual Machines versions 2.10 through 2.13 VMwar...
Stripo Inc: Memory Dump and Env Disclosure via Spring Boot Actuator
Memory Dump and Env Disclosure via Spring Boot Actuator Spring boot actuator files/endpoints can be accessed via path like stripo.email/██████/actuator/, including a 110 MB heapdump file, which expose source code, private keys and some internal data! The maximum severity of this asset is medium, ...
SQL Injection Vulnerability in ERP-PRO
ERP-PRO is based on SpringBoot 2.X framework for small and medium-sized enterprises to build open source good ERP software. ERP-PRO suffers from SQL injection vulnerability. Attackers can exploit the vulnerability to obtain sensitive information in the database...
Low: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.10 security update
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
Unauthorized Access Vulnerability in Huaxia ERP
Huaxia ERP based on SpringBoot framework , aspires to provide small and medium-sized enterprises with open source and good ERP software , currently focusing on sales and inventory + financial functions . Huaxia ERP has an unauthorized access vulnerability that can be exploited by attackers to...
Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.6.SP2 security update
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
SQL Injection Vulnerability in Mini-Tmall Framework Front and Backend
Mini Tmall Mini Tmall is a Spring Boot-based integrated B2C e-commerce platform, the requirements of the design of the main reference Tmall shopping process: users start from registration, to complete the login, browse the products, add a shopping cart, place an order, confirm receipt, evaluation...
Unauthorized Access Vulnerability in JeewxBoot of Beijing National Torch Information Technology Co.
JeewxBoot is a SpringBoot-based open source WeChat housekeeper system , using SpringBoot2.1.3 Mybatis + Velocity framework technology. Beijing State Torch Information Technology Co. JeewxBoot has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive informati...
Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.15 security and bug fix update
An update is now available for Red Hat support for Spring Boot. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
SpringBootVulExploit
This repository contains a collection of Spring Boot vulnerability exploitation tools and techniques. The tools are designed to exploit various vulnerabilities in Spring Boot applications, including remote code execution RCE, privilege escalation, and data exfiltration. The repository includes...
Engel & Völkers Technology GmbH: Information disclosure via Spring Boot Actuators on gonext-stage.engelvoelkers.com
Summary: The Spring Boot Actuators are exposing critical information on gonext-stage.engelvoelkers.com such as the last 100 HTTP requests made to the server including cookies, paths, etc and the environment configuration. The endpoints are the following: - /trace - /env - /mappings - /configprops...
XSS Vulnerability in My-Blog-layui
My-Blog-layui by SpringBoot + Layui + Mybatis + Thymeleaf and other technologies to achieve the Java blog system . My-Blog-layui has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...
GitHub Security Lab: CodeQL query to detect open Spring Boot actuator endpoints
This bug was reported directly to GitHub Security Lab...
Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.13 security and bug fix update
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.6 security and bug fix update
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Guardedbox - Online Client-Side Manager For Secure Storage And Secrets Sharing
GuardedBox is an open-source online client-side manager for secure storage and secrets sharing. It allows users to upload secrets to a centralized server and retrieve them at anytime and from anywhere. It also allows users to share their secrets with other users, individually or via groups. Secre...
Spring Boot < 1.2.8 / 1.3.0 Whitelabel Error Page Remote Code Execution
Pivotal Spring Boot is a Java framework designed to help developers create minimal Spring based applications. Spring applications provide the Spring Expression Language SpEL which is a powerful expression language for querying and manipulating an object graph at runtime. Spring Boot versions belo...
LY Corporation: Spring Actuator endpoints publicly available and broken authentication
Due to insufficient access control, it was possible to access the Spring Boot Actuator endpoints /heapdump and /env. @kazan71p identified two highly sensitive applications leaking information through these endpoints. The LINE Security team shutdown the secondary endpoints just as it was discovere...