ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), com.alipay.sofa:registry-server-data (>=5.2.0, <=5.4.3) +164 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.5.17.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.5.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-start...

com.alibaba.boot:dubbo-spring-boot-starter (0.1.2.release), com.foreach.across:across-core (3.1.2.release) +219 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.5.18.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.5.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.alibaba.boot:dubbo-spring-boot-starter...

br.com.ideotech:draw-out-spring-boot-aop (>=1.5.19.release, <=1.5.19-4.release), br.com.ideotech:draw-out-spring-boot-lib (>=1.5.19.release, <=1.5.19-4.release) +262 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.5.19.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.5.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - br.com.ideotech:draw-out-spring-boot-aop...

cn.skylarkai:license (>=1.0.0, <=1.0.2), com.eworkcloud:ework-cloud-starter-web (>=1.0.0, <=1.8.1) +172 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.5.20.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.5.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - cn.skylarkai:license =1.0.0, =1.0.0, =3.1.1.releas...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +24 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.0.1.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.ebay:lightning-client 0.9.0 -...

org.springframework.boot:spring-boot-actuator (1.1.2.release), org.springframework.boot:spring-boot-docs (1.1.2.release) +27 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.2.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - org.springframework.boot:spring-boot-actuator...

com.erudika:para (1.8.0), com.github.totyumengr:minicubes-cluster (0.2) +54 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.4.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.erudika:para 1.8.0 -...

biz.dfch.j:activiti.wrapper (>=0.0.6, <=0.0.7), com.clusterra:clusterra-email-sender (>=1.0.13.release, <=1.2.0.release) +213 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.2.3.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - biz.dfch.j:activiti.wrapper =0.0.6, =1.0.13.release...

com.github.attt:archer-spring-autoconfigure (1.0-rc1), com.github.attt:archer-spring-boot-starter (1.0-rc1) +22 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.0.0.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.github.attt:archer-spring-autoconfigure 1.0-rc1...

io.fabric8:process-spring-boot-container (1.1.0.cr2), io.fabric8:process-spring-boot-itests-invoicing (1.1.0.cr2) +33 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.1.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - io.fabric8:process-spring-boot-container 1.1.0.cr2 ...

org.grails:grails-gsp-spring-boot (1.0.0), org.springframework.boot:spring-boot-actuator (1.1.11.release) +28 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.11.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - org.grails:grails-gsp-spring-boot 1.0.0 -...

com.github.jlgrock.snp:client (0.1), com.github.jlgrock.snp:core (0.1) +77 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.2.0.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.github.jlgrock.snp:client 0.1 -...

com.canoo.dolphin-platform:dolphin-platform-server-spring (>=0.6.1, <=0.8.6), com.canoo.dolphin-platform:dolphin-platform-spring-controller-tester (0.8.6) +125 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.2.2.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: -...

com.foreach.across.modules:admin-web-module (1.1.1.release), com.foreach.across.modules:debug-web-module (1.0.1.release) +127 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.2.8.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.foreach.across.modules:admin-web-module...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-application (>=1.0.0, <=1.2.0) +24518 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=2.0.0.release, <=2.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.0, =4.4.0.1 and more Source cves: CVE-2023-20883 Source advisory: GHSA-XF96-W227-R7C4...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.djl.spring:djl-spring-boot-starter-autoconfigure (0.15) +7491 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=2.6.0, <=2.6.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.1 - ai.ylyue:yue-library-data-mybatis j11.2.6.2 and more Source cves: CVE-2023-20883 Source advisory: OSV:GHSA-XF96-W227-R7C4...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.djl.spring:djl-spring-boot-starter-autoconfigure (0.15) +7491 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=2.6.0, <=2.6.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.1 - ai.ylyue:yue-library-data-mybatis j11.2.6.2 and more Source cves: CVE-2023-20883 Source advisory: GHSA-XF96-W227-R7C4...

ai.djl.spring:djl-spring-boot-starter-autoconfigure (>=0.18, <=0.23), ai.djl.spring:djl-spring-boot-starter-mxnet-auto (>=0.18, <=0.23) +8820 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=2.7.0, <=2.7.11)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.7.0, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =1.0, =0.8.38, =0.8.38, =v0.16.1, =v0.16.1, =v0.16.1, =1.0.0, =5.3.1, =6.2.1 and more Source cves: CVE-2023-20883 Source advisory: GHSA-XF96-W227-R7C4...

ai.timefold.solver:timefold-solver-spring-boot-autoconfigure (>=0.9.38, <=0.9.39), ai.timefold.solver:timefold-solver-spring-boot-starter (>=0.9.38, <=0.9.39) +3628 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=3.0.0, <=3.0.6)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.0.0, =0.9.38, =0.9.38, =2.0.0, =3.0.0, =2.9.9-rc.2, =0.25.3-rc.11, =0.1.43, =0.1.65 - cc.vihackerframework:vihacker-annotation 1.0.8.r - cc.vihackerframework:vihacker-auth-starter 1.0.8.r -...

GHSA-XF96-W227-R7C4 Spring Boot Welcome Page Denial of Service

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service DoS attack if Spring MVC is used together with a reverse proxy cache. Specifically, an application is vulnerable if all of the condition...