Pivotal Software Spring Framework Arbitrary Command Execution Vulnerability

Pivotal Software Spring Framework is the U.S. Pivotal Software's set of open source Java, Java EE application framework. The framework helps developers build high-quality applications . An arbitrary command execution vulnerability exists in Pivotal Software Spring Framework. An attacker can explo...

Vulnerability warning: the Spring Boot framework, the expression injection vulnerability-vulnerability warning-the black bar safety net

High-risk vulnerability exposure always occurs at an unexpected moment: the weekend all of them are ready to enjoy the weekend time, the Spring Boot framework SpEL expression inject Common Vulnerability exposure exploit this vulnerability, a remote attacker on the server to execute arbitrary...

Spring Security / MVC Path Matching Inconsistency

Both Spring Security and the Spring Framework rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Securit...

Unspecified Vulnerability in Red Hat JBoss BPM Suite

Red Hat JBoss BPM Suite is a business process management platform from Red Hat, Inc. that brings together all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation and business process monitoring. A security vulnerability exists in Red Hat JBoss...

Framework: denial-of-service attack with XML input

A denial of service flaw was found in the way Spring processes inline DTD declarations. A remote attacker could submit a specially crafted XML file that would cause out-of-memory errors when parsed...

Moderate: Red Hat Security Advisory: Red Hat JBoss BPM Suite security and bug fix update

An update is now available for Red Hat JBoss BPM Suite. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

Framework: denial-of-service attack with XML input

A denial of service flaw was found in the way Spring processes inline DTD declarations. A remote attacker could submit a specially crafted XML file that would cause out-of-memory errors when parsed...

Moderate: Red Hat Security Advisory: Red Hat JBoss BRMS security and bug fix update

An update is now available for Red Hat JBoss BRMS. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Allfresco Community Edition: source code security analysis report

Several vulnerabilities were discovered in Alfresco Software 'Allfresco Community Edition' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Использование метода finalize Отсутствие верификации цифровой подписи исполняемых...

[SECURITY] Fedora 22 Update: springframework-amqp-1.3.9-4.fc22

The Spring AMQP project applies core Spring concepts to the development of AMQP-based messaging solutions. It provides a "template" as a high-level abstraction for sending and receiving messages. It also provides support for Message driven POJOs with a "listener container". These libraries...

[SECURITY] Fedora 23 Update: springframework-amqp-1.3.9-4.fc23

The Spring AMQP project applies core Spring concepts to the development of AMQP-based messaging solutions. It provides a "template" as a high-level abstraction for sending and receiving messages. It also provides support for Message driven POJOs with a "listener container". These libraries...

[SECURITY] Fedora 24 Update: springframework-amqp-1.3.9-4.fc24

The Spring AMQP project applies core Spring concepts to the development of AMQP-based messaging solutions. It provides a "template" as a high-level abstraction for sending and receiving messages. It also provides support for Message driven POJOs with a "listener container". These libraries...

Remote Code Execution in Spring AMQP

The class org.springframework.core.serializer.DefaultDeserializer does not validate the deserialized object against a whitelist. By supplying a crafted serialized object like Chris Frohoff's Commons Collection gadget, remote code execution can be achieved...

PT-2016-3367

Name of the Vulnerable Software and Affected Versions Pivotal Spring Framework versions prior to 6.0.0 Pivotal Spring Framework versions 4.2.6 and 3.2.17 Pivotal Spring Framework versions 5.3.0 through 5.3.16 Description The issue is related to the implementation of the readRemoteInvocation metho...

Spring Garden’s Care - Customized SSL, Dangerous filesystem permissions, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Spring Garden’s Care published at the 'play' market has multiple vulnerabilities...

Ocean Mania - Spring Break - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Ocean Mania - Spring Break published at the 'play' market has multiple vulnerabilities...

Spring Ninja - Dangerous filesystem permissions, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Spring Ninja published at the 'play' market has multiple vulnerabilities...

Spring Flowers Live Wallpaper - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Spring Flowers Live Wallpaper published at the 'play' market has multiple vulnerabilities...

[SECURITY] Fedora 23 Update: springframework-social-1.0.3-3.fc23

The Spring Social project allows you to integrate the APIs exposed by Software-as-a-Service SaaS providers such as Facebook and Twitter into your applications. It consists of a service provider 'connect' framework, sign-in support, and strongly-typed Java API bindings...

Netgear NMS300 ProSafe Network Management System - Multiple Vulnerabilities

Remote code execution / arbitrary file download in NETGEAR ProSafe Network Management System NMS300 Discovered by Pedro Ribeiro [email protected], Agile Information Security http://www.agileinfosec.co.uk/ ========================================================================== Disclosure:...