7014 matches found
CVE-2022-22968
CVE-2022-22968 affects Spring Framework where DataBinder’s disallowedFields patterns are case sensitive in versions 5.3.0–5.3.18, 5.2.0–5.2.20, and older unsupported releases. The issue means a field is not fully protected unless every first character (and nested path) is listed in both uppercase...
CVE-2022-22968
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the fiel...
spring-framework: RCE via Data Binding on JDK 9+
A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, transitively affected from Spring Beans, using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain...
Low: Red Hat Security Advisory: Red Hat Process Automation Manager 7.12.1 security update
An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...
spring-framework: RCE via Data Binding on JDK 9+
A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, transitively affected from Spring Beans, using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain...
SUSE-SU-2022:1217-1 Security update for tomcat
This update for tomcat fixes the following issues: Security hardening, related to Spring Framework vulnerabilities: - Deprecate getResources and always return null bsc1198136...
Binding Rules Bypass
spring-context is vulnerable to binding rules bypass. The vulnerability exists due to lack of sanitization of HTTP request parameters which allows an attacker to bypass the disallowedFields and bind malicious HTTP request parameters...
Exploit for Code Injection in Vmware Spring_Cloud_Function
Spring Cloud Function SpEL Expression Injection Vulnerability...
VMware Spring Cloud Function < 3.1.7 / 3.2.x < 3.2.3 SPEL Expression Injection (local check)
The version of Spring Cloud Function running on the remote host is affected by a remote code execution vulnerability in the routing functionality. A remote, unauthenticated attacker could provide a specially crafted SpEL as a routing expression that may result in remote code execution on the remo...
spring-framework: RCE via Data Binding on JDK 9+
A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, transitively affected from Spring Beans, using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain...
Spring Framework Data Binding Rules Vulnerability (CVE-2022-22968)
Table of Contents Overview Does This Affect My Application? Reassessing Your Data Binding Approach Overview While investigating the Spring Framework RCE vulnerability CVE-2022-22965 and the suggested workaround, we realized that the disallowedFields configuration setting on WebDataBinder is not...
Vmware Spring Framework 安全特征问题漏洞
Vmware Spring Framework is the United States, Vmware Vmware company's set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. Vmware Spring Framework has a security feature issue vulnerability that stems from the pattern of...
JHipster SQL Injection Vulnerability
JHipster is an open source application builder that develops web applications and microservices primarily using Angular or React and Spring Framework.JHipster suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements, whic...
The vulnerability lies in the implementation of the TrustManager library’s authentication verification technology for creating Spring Cloud Gateway API gateways. This allows attackers to access remote services.
The vulnerability of the implementation of the TrustManager library for creating Spring Cloud Gateway API gateways is related to errors in the authentication process. Exploiting this vulnerability can allow attackers to access remote services...
The vulnerability of the `readRemoteInvocation` method implementation in the HTTP request handler based on the Servlet-API `HttpInvokerServiceExporter` of the Spring Framework allows a attacker to execute arbitrary code.
The vulnerability of the readRemoteInvocation method implemented by the HTTP-request handler based on the Servlet-API HttpInvokerServiceExporter in the Spring Framework software platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious...
This Week in Spring - April 12th, 2022 (Devnexus 2022 Edition!!)
This Week in Spring - Devnexus Edition Hi, Spring fans! Welcome to another installment of This Week in Spring - Im at my first in-person event since the virus: Devnexus! WOOHOOO!! Well, technically Im still in San Francisco as I write this, but Ill be in Atlanta, GA tomorrow for… Devnexus! I hope...
Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.5.10 update
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For...
Low: Red Hat Security Advisory: Red Hat Integration Camel-K 1.6.5 security update
A micro version update from 1.6.4 to 1.6.5 is now available for Red Hat Integration Camel K. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Low. A Common...
spring-framework: RCE via Data Binding on JDK 9+
A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, transitively affected from Spring Beans, using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain...
