6978 matches found
This Week in Spring - July 12th, 2022
Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? This week Im writing you from sunny Seattle, Washington, where were having our next installment of the SpringOne Tour series. Its been a ton of fun seeing all these fun and friendly faces again and getting to see...
Exploit for Code Injection in Vmware Spring_Cloud_Gateway
Copied from Original: - ht...
GHSA-CM59-PR5Q-CW85 Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. The vulnerable method is used to create a work directory for embedd...
Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. The vulnerable method is used to create a work directory for embedd...
The vulnerability of the RegexRequestMatcher component in the Spring Security Java framework allows attackers to escalate their privileges.
The vulnerability of the RegexRequestMatcher component in the Spring Security Java framework, which is used for securing industrial applications, is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...
springframework: DoS with STOMP over WebSocket
A flaw was found in Spring Framework Applications. Applications that use STOMP over the WebSocket endpoint are vulnerable to a denial of service attack caused by an authenticated user...
springframework: DoS via data binding to multipartFile or servlet part
A flaw was found in Spring Framework. Applications that handle file uploads are vulnerable to a denial of service DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object...
Framework: Data Binding Rules Vulnerability
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the fiel...
springframework: malicious input leads to insertion of additional log entries
In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries...
springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096)
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more...
spring-expression: Denial of service via specially crafted SpEL expression
A flaw was found in the Spring Framework. This flaw allows an attacker to craft a special Spring Expression, causing a denial of service...
spring-security: Denial-of-Service (DoS) attack via initiation of Authorization Request
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker c...
Important: Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update
A minor version update from 7.10 to 7.11 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...
springframework: BCrypt skips salt rounds for work factor of 31
A flaw was found in Spring Framework. The encoder does not perform any salt rounds when using the BCrypt class with the maximum work factor 31 due to an integer overflow error...
springframework: Authorization Bypass in RegexRequestMatcher
A flaw was found in Spring Security. When using RegexRequestMatcher, an easy misconfiguration can bypass some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...
Spring Shell 2.1.0-RC1 is now available
On behalf of the team and everyone who has contributed, Im happy to announce that Spring Shell 2.1.0-RC1 has been released and is now available from . Please see the release notes for more details. Thanks to all those who have contributed with issue reports and pull requests. How can you help?...
Mini-Tmall 安全漏洞
Mini-Tmall is a Spring Boot-based mini-Tmall mall , fast deployment run , suitable for use as a Bijou template . A security vulnerability exists in Mini-Tmall v1.0. An attacker exploits the vulnerability to perform an insecure privilege attack via tomcat-embed-jasper...
Security Bulletin: IBM Tivoli Netcool Impact is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)
Summary IBM Tivoli Netcool Impact is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965.Spring is shipped as part of ActiveMQ package but is not used by the product. The fix removes Spring from the product. Vulnerability Details...
This Week in Spring - July 5th, 2022
Hi, Spring fans! Welcome to another installment of This Week in Spring! This weeks all sorts of weird for me. Its Tuesday! But here in the US we just celebrated the 4th of July, and I, like many Americans, took a long weekend. Took some time with the family to do a little road trip up north to...