com.jfinal:jfinal-undertow (2.0), com.jfinal:jfinal-weixin (2.5) +5 more potentially affected by CVE-2024-22492 via com.jfinal:jfinal (4.8)

com.jfinal:jfinal MAVEN version 4.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 2.0 - com.jfinal:jfinal-weixin 2.5 - io.jboot:jboot =2.3.1, =3.1.0, =3.5.8.v20191228-release, =0.0.1...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2024-22492 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2024-22492 Source...

Spring Tips: Spring Data JDBC

Hi, Spring fans! In this installment, Josh Long looks at the fantastic Spring Data JDBC project, which is one of the easiest and most powerful ways to leverage JDBC in a Spring Boot application...

Eva SQL Injection Vulnerability

Eva Eva is a coderd-repos open source based on SpringBoot, Mybatis Plus, open source backend management system project framework. Eva 1.0.0 version of the existence of SQL injection vulnerability , the vulnerability stems from /system/traceLog/page page SQL injection vulnerability...

This Week in Spring - January 9th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's the second week of 2024, and I am already thinking about 2025! And, a bit more immediatelt than that: the next two weeks. I'll be at both VOXXED DAYS Ticino and VOXXED DAYS CERN, both in Switzerland. If you're about, com...

This Week in Spring - January 2nd, 2024

Hi, Spring fans! Happy New Year! As we step into 2024, full of hope and enthusiasm, welcome to the first installment of This Week in Spring. It's a time for new beginnings and resolutions, and what better way to start than by exploring the ever-evolving world of Spring? I hope your new year...

org.infinispan:infinispan-javadoc-all (12.0.0.cr1), org.infinispan:infinispan-server-router (12.0.0.cr1) +6 more potentially affected by CVE-2023-3628 via org.infinispan:infinispan-server-rest (12.0.0.cr1)

org.infinispan:infinispan-server-rest MAVEN version 12.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-server-rest and may be impacted: - org.infinispan:infinispan-javadoc-all 12.0.0.cr1 -...

org.infinispan:infinispan-docs (12.0.0.dev04), org.infinispan:infinispan-javadoc-all (12.0.0.dev04) +7 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-cachestore-remote (12.0.0.dev04)

org.infinispan:infinispan-cachestore-remote MAVEN version 12.0.0.dev04 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-cachestore-remote and may be impacted: - org.infinispan:infinispan-docs 12.0.0.dev04 -...

org.apache.camel.springboot:camel-infinispan-embedded-starter (>=3.14.8, <=3.14.10), org.apache.camel.springboot:camel-infinispan-starter (>=3.14.8, <=3.14.10) +51 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-core (12.1.14.final)

org.infinispan:infinispan-core MAVEN version 12.1.14.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.apache.camel.springboot:camel-infinispan-embedded-starter =3.14.8, =3.14.8, =3.14.10 -...

cn.vertxup:aeon-ambient (0.9.0), cn.vertxup:aeon-aurora (0.9.0) +76 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-core (13.0.15.final)

org.infinispan:infinispan-core MAVEN version 13.0.15.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - cn.vertxup:aeon-ambient 0.9.0 - cn.vertxup:aeon-aurora 0.9.0 - cn.vertxup:aeon-code 0.9.0 -...

This Year in Spring - 2023

Welcome to another installment of This Week in Spring! It's December 26th, 2023, and we're staring down the new year! And you know what that means, right? It's time for our annual roundup, looking at all the latest and greatest in the wild and wonderful world of Springdom. This is This Year in...

Design/Logic Flaw

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue...

CVE-2023-51650 Unauthorized access vulnerability on three interfaces

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue...

CVE-2023-51650 Unauthorized access vulnerability on three interfaces

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue...

CVE-2023-51650: Missing Authorization

Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue...

PT-2023-31868 · Hertzbeat · Hertzbeat

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is an open source, real-time monitoring system. Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces, potentially resulting in the...

Hertzbeat Security Vulnerabilities

Hertzbeat is an open source real-time monitoring system from the dromara organization. A security vulnerability exists in Hertzbeat versions prior to 1.4.1 that stems from a misconfiguration of Spring Boot permissions, resulting in unauthorized access vulnerabilities in three interfaces...

Spring Boot Improper Resource Cleanup DoS

The vulnerability of the Spring Boot web application framework lies in improper resource cleanup or release mechanisms. Exploiting this vulnerability allows an attacker to trigger a service failure through a specially crafted HTTP request...

This Week in Spring - December 19th, 2023

Hi, Spring fans! Welcome to another oh-so-festive edition of This Week in Spring! the Spring Authorization Server 1.2.1, 1.1.14, and 0.4.5, are now available Spring AMQP 3.1.1 is now available Spring Security 5.8.9, 6.1.6, 6.2.1 are now available Spring for Apache Kakfa 3.1.1 is now available...

org.apache.dubbo:dubbo-spring-boot-actuator (3.1.5), org.apache.dubbo:dubbo-spring-boot-actuator-compatible (3.1.5) +5 more potentially affected by CVE-2023-46279 via org.apache.dubbo:dubbo (3.1.5)

org.apache.dubbo:dubbo MAVEN version 3.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dubbo:dubbo and may be impacted: - org.apache.dubbo:dubbo-spring-boot-actuator 3.1.5 - org.apache.dubbo:dubbo-spring-boot-actuator-compatible 3.1.5 -...