129 matches found
UBUNTU-CVE-2020-5397
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...
Denial of service
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...
CVE-2018-15756
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...
ai.foremast.metrics:foremast-spring-4x-k8s-metrics (>=0.1.6 <=0.2.0), at.researchstudio.sat:won-node (>=0.4 <=0.6) +3886 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (>=4.3.0.RELEASE <=4.3.4.RELEASE)
org.springframework:spring-webmvc MAVEN version =4.3.0.RELEASE, =0.1.6, =0.4, =0.4, =0.4, =0.4, =4.1.0, =4.0.0, =3.5.19, =3.5.19, =1, =1, =1, =1, =1, =0.1, =0.13.6 and more Source cves: CVE-2016-9878 Source advisory: OSV:GHSA-2M8H-FGR8-2Q9W...
at.chrl:chrl-orm-spring-integration (=1.1.0), au.com.dius:pact-jvm-provider-spring_2.11 (>=3.4.0 <=3.5.18) +1406 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (>=4.2.0.RELEASE <=4.2.8.RELEASE)
org.springframework:spring-webmvc MAVEN version =4.2.0.RELEASE, =3.4.0, =3.5.4-rc.0, =1, =1.4, =1.4, =1.0.4, =0.0.10, =1.6.0, =0.0.21, =0.0.21, =0.0.21, =0.0.21, =0.0.22 and more Source cves: CVE-2016-9878 Source advisory: OSV:GHSA-2M8H-FGR8-2Q9W...
RPD:bmc-rpd (=1.1), aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1 <=0.0.6) +2512 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (>=1.2.1 <=3.2.17.RELEASE)
org.springframework:spring-webmvc MAVEN version =1.2.1, =0.0.1, =1.0, =0.0.20, =1.0, =0.0.1, =0.1.0, =1.0.0, =0.2, =3.0.1, =4.0.0 - cn.fastoo:fastoo-java-api =20171130 - cn.opencodes:alpha-common-utils =1.0.0 and more Source cves: CVE-2016-9878 Source advisory: OSV:GHSA-2M8H-FGR8-2Q9W...
Directory Traversal
spring-webmvc is vulnerable to directory traversal attack. The vulnerability exists due to the improper sanitization of the path values which allows valid Windows files to be served as static resources. This vulnerability only affects spring-webmvc running on Windows which allows serving files wi...
