7886 matches found
Denial Of Service (DoS)
org.springframework, spring-webmvc is vulnerable to Denial of Service DoS. The vulnerability is caused by inefficient handling of large request bodies in controller methods with an @RequestBody byte parameter, which allows an attacker to lead to resource exhaustion...
Case Insensitive Input Validation
org.springframework, spring-context is vulnerable to Case Insensitive Input Validation. The vulnerability is due to improper handling of case insensitivity in String.toLowerCase, where the fix for making disallowedFields patterns case insensitive inadvertently introduced a risk. This behavior...
CVE-2024-38819
A flaw was found in the Spring Framework. Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. This flaw allows an attacker to craft malicious HTTP requests and obtain any file on the file system that is also...
Spring Framework 5.3.x < 5.3.42 DoS (CVE-2024-38828)
The remote host contains a Spring Framework version that is affected by a denial of service vulnerability where Spring MVC controller methods with an @RequestBody byte method parameter are vulnerable to a DoS attack. Note that Nessus has not tested for this issue but has instead relied only on th...
Exploit for Allocation of Resources Without Limits or Throttling in Vmware Spring_Framework
Spring CVE-2022-22970 Proof of Concept This repo contains...
Exploit for CVE-2024-22262
Spring CVE-2024-22262 Proof of Concept This repo contains...
K000148606: Spring vulnerability CVE-2021-22119
Security Advisory Description Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. ...
PT-2024-8762
Name of the Vulnerable Software and Affected Versions Spring Security affected versions not specified Description The issue is related to the use of String.toLowerCase and String.toUpperCase functions in the Java framework for Spring Security, which can lead to improper authorization. This is due...
This Week in Spring - November 19th, 2024
Hi, Spring fans! How are you? Can you believe we're already staring at the end of the month? It's that time of the year when we see new releases, and the new releases reflect that frenzy! Soon: Spring Boot 3.4.0! Are you updated? Make sure you're updated! Remember: Spring projects leave open sour...
Spring LDAP Spring LDAP sensitive data exposure for case-sensitive comparisons
The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820...
PT-2024-9997
Name of the Vulnerable Software and Affected Versions: Spring LDAP versions 2.4.0 through 2.4.3 Spring LDAP versions 3.0.0 through 3.2.7 Description: The issue is related to insufficient case sensitivity checking in the String.toLowerCase and String.toUpperCase functions of the Spring LDAP projec...
Why Spring AI: The Seamless Path to Generative AI
Why Spring AI: The Seamless Path for Spring Developers to the World of Generative AI Intro As a Java developer exploring the world of generative AI, you’re probably aware of several frameworks that promise to make AI integration easy. I believe Spring AI stands out as the natural choice, especial...
Spring Security Authorization Bypass for Case Sensitive Comparisons
The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in authorization rules not working properly. Related to CVE-2024-38820...
CVE-2024-38828
A flaw was found in the Spring Framework. In certain versions, Spring MVC controller methods with a @RequestBody byte method parameter are vulnerable to a denial of service attack...
GHSA-W3C8-7R8F-9JP8 Spring MVC controller vulnerable to a DoS attack
Spring MVC controller methods with an @RequestBody byte method parameter are vulnerable to a DoS attack...
Spring MVC controller vulnerable to a DoS attack
Spring MVC controller methods with an @RequestBody byte method parameter are vulnerable to a DoS attack...
africa.absa:inception-api (>=1.1.0 <=1.2.0), africa.absa:inception-codes-api (>=1.1.0 <=1.2.0) +10791 more potentially affected by CVE-2024-38828 via org.springframework:spring-webmvc (>=5.3.0 <=5.3.4)
org.springframework:spring-webmvc MAVEN version =5.3.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =4.4.0.2, =1.4.2, =1.6.6, =1.6.6.1 - ai.platon:distributed-lock-example =1.4.2 and more Source cves: CVE-2024-38828 Source advisory: OSV:GHSA-W3C8-7R8F-9JP8...
DEBIAN-CVE-2024-38828
Spring MVC controller methods with an @RequestBody byte method parameter are vulnerable to a DoS attack...
