CVE-2020-5428

Summary: CVE-2020-5428 affects Spring Cloud Task 2.2.4.RELEASE and earlier, with a reported SQL injection in the TaskExplorer lookup queries. The root cause is described as insufficient input validation in the PageRequest value used by JdbcTaskExecutionDao, potentially allowing arbitrary SQL exec...

CVE-2020-5427

Spring Cloud Data Flow is affected by CVE-2020-5427 in versions 2.6.x prior to 2.6.5 and 2.5.x prior to 2.5.4, where the task execution sorting query is vulnerable to SQL injection. The issue stems from the vulnerable SQL path when requesting task execution. Remediation is to upgrade to version 2...

CVE-2020-5427 Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query

In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when requesting task execution...

PT-2021-12401 · Spring · Spring Cloud Data Flow

Name of the Vulnerable Software and Affected Versions: Spring Cloud Data Flow versions 2.5.x prior to 2.5.4 Spring Cloud Data Flow versions 2.6.x prior to 2.6.5 Description: The application is vulnerable to SQL injection when requesting task execution. Recommendations: For versions 2.5.x prior to...

Vmware Spring Cloud Task Application Starters SQL Injection Vulnerability

Vmware Spring Cloud Task Application Starters is a codebase for managing and executing scheduled tasks from Vmware USA. The application runs as a standalone Spring Boot application and supports operations such as database migration, machine learning, and scheduled... A SQL injection vulnerability...

Vmware Spring Cloud Data Flow SQL Injection Vulnerability

Vmware Spring Cloud Data Flow is a code library for streaming and batch data processing in microservices from Vmware, Inc. A SQL injection vulnerability exists in Spring Cloud Data Flow versions 2.6.x prior to 2.6.5, versions 2.5.x prior to 2.5.4, which stems from the vulnerability of the...

The vulnerability of the spring-cloud-config-server module of the Spring Cloud Config server allows a attacker to gain access to protected information.

The vulnerability of the spring-cloud-config-server module in the Spring Cloud Config server exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected informatio...

Unspecified Vulnerability in VMware Spring Cloud Netflix

Spring Cloud Netflix is various Netflix OSS component integrations. A security vulnerability exists in VMware Spring Cloud Netflix versions 2.2.x prior to 2.2.4, 2.1.x prior to 2.1.6, and unsupported older versions, which can be exploited by an attacker to send requests to other servers...

CVE-2020-5412

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can...

Design/Logic Flaw

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can...

CVE-2020-5412

Spring Cloud Netflix is affected in versions 2.2.x < 2.2.4 and 2.1.x

cn.strongculture:prometheus-spring-boot-starter (=1.0.0), com.buession.springcloud.stream:buession-springcloud-stream-core (>=2.2.1 <=2.3.3) +105 more potentially affected by CVE-2020-5413 via org.springframework.integration:spring-integration-core (>=5.3.0.RELEASE <=5.3.1.RELEASE)

org.springframework.integration:spring-integration-core MAVEN version =5.3.0.RELEASE, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.2.1, =2.3.3...

Unauthorized Access Vulnerability in SpringBlade of Shanghai Bred Network Technology

SpringBlade is a SpringCloud distributed microservices architecture upgraded and optimized from a commercial-grade project. Shanghai Bred Network Technology SpringBlade has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...

Directory Traversal in Spring Cloud Config Server

This module exploits an unauthenticated directory traversal vulnerability which exists in Spring Cloud Config versions 2.2.x prior to 2.2.3 and 2.1.x prior to 2.1.9, and older unsupported versions. Spring Cloud Config listens by default on port 8888. This module requires Metasploit:...

Exploit for Path Traversal in Vmware Spring_Cloud_Config

CVE-2020-5410 Spring Cloud Config directory traversal vulnera...

GHSA-32XF-JWMV-9HF3 Directory traversal attack in Spring Cloud Config

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

ai.hyacinth.framework:core-service-config-server (=0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (=3.1.0.RELEASE) +34 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.RELEASE <=2.2.2.RELEASE)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.RELEASE, =0.0.1-RELEASE, =1.1.1, =0.1.0, =0.2.0 and more Source cves: CVE-2020-5410 Source advisory: OSV:GHSA-32XF-JWMV-9HF3https://vulners...

Directory traversal attack in Spring Cloud Config

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

ai.hyacinth.framework:core-service-config-server (>=0.5.0 <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.RELEASE <=2.1.1.RELEASE) +18 more potentially affected by CVE-2020-5410 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.RELEASE <=2.1.8.RELEASE)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.RELEASE, =0.5.0, =2.1.0.RELEASE, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.4.RELEASE - org.springframework.cloud.stream.app:python-jython-processor-ra...

ai.hyacinth.framework:core-service-config-server (>=0.5.0 <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.1.0.RELEASE <=2.1.1.RELEASE) +17 more potentially affected by CVE-2020-5405 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.RELEASE <=2.1.6.RELEASE)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.RELEASE, =0.5.0, =2.1.0.RELEASE, =1.2.0, =1.0.0, =6.0.1, =6.0.1, =6.0.1, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.0.RELEASE, =2.1.4.RELEASE - org.springframework.cloud.stream.app:spring-...