com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.1.27-release) +396 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=4.1.5.release, <=4.3.17.release)

org.springframework.integration:spring-integration-xml MAVEN version =4.1.5.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.1.0-release, =1.0.83-rc1, =1.0.83-rc1, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.2.0, =2.4.0 and more Source cves:...

org.springframework.integration:spring-integration-samples (1.0.2.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.2.release)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.1.6-release), org.springframework.cloud.stream.app:aggregate-counter-app-starters-build (>=2.0.0.release, <=2.0.2.release) +294 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=5.0.1.release, <=5.0.9.release)

org.springframework.integration:spring-integration-xml MAVEN version =5.0.1.release, =2.0.0-rc1, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2...

org.springframework.integration:spring-integration-samples (1.0.1.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.1.release)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.1.27-release) +396 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=4.1.5.release, <=4.3.17.release)

org.springframework.integration:spring-integration-xml MAVEN version =4.1.5.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.1.0-release, =1.0.83-rc1, =1.0.83-rc1, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.2.0, =2.4.0 and more Source cves:...

com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.1.6-release), org.springframework.cloud.stream.app:aggregate-counter-app-starters-build (>=2.0.0.release, <=2.0.2.release) +294 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=5.0.1.release, <=5.0.9.release)

org.springframework.integration:spring-integration-xml MAVEN version =5.0.1.release, =2.0.0-rc1, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2...

org.springframework.integration:spring-integration-samples (1.0.2.sr1) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.2.sr1)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.2.sr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (3.0.0.release)

org.springframework.integration:spring-integration-xml MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772: Improper Restriction of XML External Entity Reference

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...