Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

WebMvc.fn/WebFlux.fn - Path Traversal

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

Apache ActiveMQ - Remote Code Execution

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

Spring Cloud Config Server - Path Traversal

Spring Cloud 3.1.x 3.1.13, 4.1.x 4.1.9, 4.2.x 4.2.3, 4.3.x 4.3.2, and 5.0.x 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request. i...

Spring Data Commons - Remote Code Execution

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

Spring MVC Framework - Local File Inclusion

Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. A malicious user can send a request using a...

Spring-Data-Mongodb-Demo

Spring-Data-Mongodb-Demo Окружение CVE-2022-22980...

ff4j__ff4j_CVE-2022-44262_1-8-13

✨✨✨ FF4J - Feature Flipping for Java ✨✨✨ Codacy Badge FF4j, is an implementation of the Feature Toggle pattern. 🤘Features Feature Toggle: Enable. and disable features at runtime - no deployments. In your code implement multiple paths protected by dynamic predicates if/then/else. Role-based...

CVE-2022-22965

🚨 CVE-2022-22965 — "Spring4Shell" Critical Remote Code Execution RCE vulnerability Publicly disclosed: March 31, 2022 📖 Table of Contents Overview Affected Components Technical Root Cause Exploitation Conditions Impact Severity & CVSS Mitigation & Patching Timeline Comparison with Log4Shell Summa...

CVE-2022-22965

👾 CVE-2022-22965 This is a proof of concept of an exploit for CVE-2022-22965 spring4shell vulnerability. It is composed by: A vulnerable Springboot application; An exploit script written in python; A safe app for test that the exploit doesn't work; A dockerfile for running the vulnerable...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Это Java-программа, эксплуатирующая уязвимость Spring Break CVE-2017-8046. Это программное обеспечение написано так, чтобы иметь как можно меньше внешних зависимостей. ДИСКЛЕЙМЕР Этот инструмент предназначен для инженеров по безопасности и специалистов по безопасности...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 This is a Java program that exploits Spring Break vulnerability CVE-2017-8046. This software is written to have as less external dependencies as possible. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...

spring4shell-poc

POC Spring4Shell Description de la vulnérabilité : https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construction du POC : https://github.com/BobTheShoplifter/Spring4Shell-POC Étapes pour construire/exécuter Testé avec JDK 11.0.14, Spring Boot 2.6.5 et Apache Tomcat...

CVE-2021-21234

CVE-2021-21234 Vulnérabilité de traversée de répertoire dans la bibliothèque spring-boot-actuator-logview https://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234...

Spring4Shell-POC

Приложение PoC для Spring4Shell Это докеризованное приложение, уязвимое к уязвимости Spring4Shell CVE-2022-22965. Полный исходный код Java для war-файла предоставлен и может быть изменён; war-файл будет пересобран при каждой сборке docker-образа. Затем собранный WAR будет загружен Tomcat. В этом...

spring4shell-scan

spring4shell-scan Un scanner entièrement automatisé, fiable et précis pour détecter les vulnérabilités Spring4Shell et Spring Cloud RCE Fonctionnalités Prise en charge des listes d'URL. Fuzzing avec plus de 10 nouvelles charges utiles Spring4Shell les outils précédemment vus utilisent seulement 1...

Spring4Shell-CTF

Spring4Shell CVE-2022-22965 Vulnerability Environment Setup and CTF Challenge Design Project Overview This project includes dual-track security research implementations: 1. Traditional Vulhub Environment Setup : Leveraging the open-source Vulhub vulnerability database to quickly reproduce the...

Spring4Shell-POC

Spring4Shell CVE-2022-22965 - Remote Code Execution Proof of Concept Полностью контейнеризированная Proof of Concept PoC , демонстрирующая эксплуатацию Spring4Shell CVE-2022-22965 и приводящая к удалённому выполнению кода RCE в уязвимом приложении Spring Framework, развёрнутом на Apache Tomcat...