com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.4, <=0.2.4), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.4, <=0.2.4) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.3.4)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.4, =0.1.4, =0.2.4 Source cve...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.2, <=0.2.2), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.2, <=0.2.2) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.3.1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.2, =0.1.2, =0.2.2 Source cve...

Mini-Tmall SQL Injection Vulnerability

Mini-Tmall is a Spring Boot-based mini-Tmall mall, fast deployment runtime, suitable for use as a Bijou template. Mini-Tmall suffers from a SQL injection vulnerability, which stems from the fact that incorrect manipulation of the parameter orderBy can lead to sql injection...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.7.13 security update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2023-20873

A flaw was found in Spring Boot. This targets specifically 'spring-boot-actuator-autoconfigure' package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are...

spring-boot:ConfigurationMetadataRepositoryJsonBuilderFuzzer: Security exception in org.json.JSONArray.writeTo

Detailed Report: https://oss-fuzz.com/testcase?key=4867254330982400 Project: spring-boot Fuzzing Engine: libFuzzer Fuzz Target: ConfigurationMetadataRepositoryJsonBuilderFuzzer Job Type: libfuzzerasanspring-boot Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

com.linecorp.armeria:armeria-grpc (0.86.0), com.linecorp.armeria:armeria-grpc-protocol (0.86.0) +36 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.86.0)

com.linecorp.armeria:armeria MAVEN version 0.86.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.86.0 - com.linecorp.armeria:armeria-grpc-protocol 0.86.0 -...

com.linecorp.armeria:armeria-grpc (0.49.0), com.linecorp.armeria:armeria-jetty (0.49.0) +12 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.49.0)

com.linecorp.armeria:armeria MAVEN version 0.49.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.49.0 - com.linecorp.armeria:armeria-jetty 0.49.0 -...

com.linecorp.armeria:armeria-grpc (0.84.0), com.linecorp.armeria:armeria-grpc-protocol (0.84.0) +37 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.84.0)

com.linecorp.armeria:armeria MAVEN version 0.84.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.84.0 - com.linecorp.armeria:armeria-grpc-protocol 0.84.0 -...

Security Bulletin: VMware Tanzu Spring Boot is vulnerable to CVE-2023-20883 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses VMware Tanzu Spring Boot which is vulnerable to CVE-2023-20883. Vulnerability Details CVEID:CVE-2023-20883 DESCRIPTION: VMware Tanzu Spring Boot is vulnerable to a denial of service, caused by a flaw when Spring MVC is used together wi...

Exploit for SQL Injection in Apache Log4J

CVE-2022-23305 Log4j JDBCAppender sql injection POC This is a...

cloud.opencode.base:opencode-base-token (1.0.0), io.github.junxworks:junx-ep-auth (>=2.0.0, <=2.1.0) +11 more potentially affected by CVE-2023-34478 via org.apache.shiro:shiro-web (>=2.0.0-alpha-1, <=2.0.0-alpha-2)

org.apache.shiro:shiro-web MAVEN version =2.0.0-alpha-1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-2 Source cves: CVE-2023-34478 Source advisory: MEND:CVE-2023-34478...

Important: Red Hat Security Advisory: Red Hat Build of OptaPlanner 8.38.0 for Quarkus 2.13.8 security update

Red Hat Build of OptaPlanner 8.38.0 for Quarkus 2.13.8 release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scori...

io.fabric8:process-spring-boot-itests-invoicing (>=1.1.0.cr2, <=1.1.0.cr3), io.fabric8:process-spring-boot-itests-service-invoicing (>=1.1.0.cr2, <=1.1.0.cr5) +3 more potentially affected by CVE-2023-34036 via org.springframework.hateoas:spring-hateoas (0.12.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - io.fabric8:process-spring-boot-itests-invoicing =1.1.0.cr2,...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in VMware Tanzu Spring Boot

Summary Multiple vulnerabilities in VMware Tanzu Spring Boot used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2023-20883 DESCRIPTION: VMware Tanzu Spring Boot is vulnerable to a denial of service, caused by a flaw when Spring MVC is used together with a...

cn.home1:oss-admin (>=1.0.6.oss, <=1.0.7.oss), de.codecentric:spring-boot-admin-sample (1.4.4) +6 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.4.4)

de.codecentric:spring-boot-admin-server MAVEN version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - cn.home1:oss-admin =1.0.6.oss, =1.0.7.oss - de.codecentric:spring-boot-admin-samp...

de.codecentric:spring-boot-admin-sample (1.5.0), de.codecentric:spring-boot-admin-sample-consul (1.5.0) +6 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.5.0)

de.codecentric:spring-boot-admin-server MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - de.codecentric:spring-boot-admin-sample 1.5.0 -...

com.ecfront.dew:monitor (1.2.2-rc), de.codecentric:spring-boot-admin-sample (1.5.4) +7 more potentially affected by CVE-2023-38286 via de.codecentric:spring-boot-admin-server (1.5.4)

de.codecentric:spring-boot-admin-server MAVEN version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on de.codecentric:spring-boot-admin-server and may be impacted: - com.ecfront.dew:monitor 1.2.2-rc - de.codecentric:spring-boot-admin-sample 1.5.4 ...

GHSA-7GJ7-224W-VPR3 Spring-boot-admin sandbox bypass via crafted HTML

Thymeleaf through 3.1.1.RELEASE as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 allows for a sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there is write access ...