CVE-2024-38819

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

CVE-2024-38819

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

cn.herodotus.engine:message-spring-boot-starter (>=2.7.3.4 <=3.0.0-M2), com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0 <=4.1.1) +217 more potentially affected by CVE-2024-56128 via org.apache.kafka:kafka_2.13 (>=2.4.0 <=3.7.1)

org.apache.kafka:kafka2.13 MAVEN version =2.4.0, =2.7.3.4, =4.0.0, =4.0.0, =4.0.0, =4.0.1, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.7.4-SNAPSHOT-35e64fa - com.bisnode.kafka.authorizat...

USN-7165-1 libspring-java vulnerability

It was discovered that the Spring Framework incorrectly handled web requests via data binding. An attacker could possibly use this issue to achieve remote code execution and obtain sensitive information...

USN-7165-1: Spring Framework vulnerability

It was discovered that the Spring Framework incorrectly handled web requests via data binding. An attacker could possibly use this issue to achieve remote code execution and obtain sensitive information...

This Week in Spring - December 17th, 2024

This Week in Spring - December 17th, 2024 Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! It's the 17th of December, 2024! And you know what means? The end of the year is nearly upon us! I can't believe it. It's been a very long year indeed, but I'm happy to get on board a...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Spring Framework vulnerability (USN-7165-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7165-1 advisory. It was discovered that the Spring Framework incorrectly handled web requests via data binding. An attacker could...

Under the Radar: Exploring Spring Boot Actuator Misconfigurations

Wiz Threat Research investigates misconfigurations in Spring Boot Actuator’s endpoints that can leak environment variables, passwords, and API keys, and even lead to remote code execution...

Sensitive Information Exposure

org.springframework.ldap:spring-ldap-core is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper handling of case conversions using String.toLowerCase and String.toUpperCase methods, which can have locale-dependent exceptions. This may lead to unintended columns bei...

Exploit for CVE-2024-38819

CVE-2024-38819: Proof of Concept PoC This is a proof of con...

spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource

A flaw was found in Spring applications using the WebMvc.fn or WebFlux.fn frameworks. This issue can allow attackers to perform path traversal attacks via crafted HTTP requests when the application serves static resources using RouterFunctions and explicitly configures resource handling with a...

K000148958: Spring WebFlux vulnerability CVE-2024-38821

Security Advisory Description Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: It must be a WebFlux application It must be using Spring's...

A Bootiful Podcast: the amazing K. Siva Prasad Reddy (SivaLabs)

Hi, Spring fans! In today's installment I talk to industry legend K. Siva Prasad Reddy @sivalabs. You've probably read one of his blogs. I know I have!...

A Bootiful Podcast: Intact's Luke Shannon

Hi, Spring fans! and happy holidays! in this installment I talk to Intact's Luke Shannon about their use of Spring, developer portals, and so much more...

Announcing Spring AI MCP: A Java SDK for the Model Context Protocol

We're excited to introduce Spring AI MCP, a robust Java SDK implementation of the Model Context Protocol MCP. This new addition to the Spring AI ecosystem brings standardized AI model integration capabilities to the Java platform. What is MCP? The Model Context Protocol MCP is an open protocol th...

Introducing Spring AI Amazon Bedrock Nova Integration via Converse API

The Amazon Bedrock Nova models represent a new generation of foundation models supporting a broad range of use cases, from text and image understanding to video-to-text analysis. With the Spring AI Bedrock Converse API integration, developers can seamlessly connect to these advanced Nova models a...

This Week in Spring - December 10th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this I am in the southern hemisphere it's summer down here!, in Brisbane, waiting to board a plane for Sydney. It's been a ton of fun! I did a video looking at the latest-and-greatest in Spring Framework 6.2 - chec...

A Bootiful Podcast: Spring Security lead Rob Winch on the amazing Spring Security 6.4 release

Hi, Spring fans! In this installment, we'll talk to the amazing Rob Winch, lead of Spring Security 6.4, about the jam-packed new release! spring springboot security java...

CVE-2024-38829

A flaw was found in Spring LDAP. The usage of String.toLowerCase and String.toUpperCase has some locale dependent exceptions that could result in unintended columns being queried...

GHSA-MQVR-2RP8-J7H4 Spring LDAP data exposure vulnerability

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase and...