Lucene search
+L
SpringMost viewed

935 matches found

Spring Security Advisories
Spring Security Advisories
added 2024/10/08 12:0 a.m.10 views

This Week in Spring - October 8th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Antwerp, Belgium, for the amazing Devoxx Belgium 2024 event! I am so happy to be back here, one of the best shows in the Java ecosystem! We've got a lot to get into so let's dive right in! From Spring Cloud Data Flow...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/10/07 12:0 a.m.10 views

From Spring Cloud Data Flow 2.11.x to 3.0

Dear Spring Community, With the recent announcement of Spring Framework 7.0 and Spring Boot 4.0, the Spring Cloud Data Flow team is pleased to announce the next major release, SCDF 3.0, to align with both Spring Framework 7.0 and Spring Boot 4.0. This will bring the following SCDF ecosystem of...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/09/12 12:0 a.m.10 views

A Bootiful Podcast: Spring creator and cofounder, Dr. Rod Johnson

In this wide-ranging interview, I finally sit down one-on-one and talk to Dr. Rod Johnson, the creator of Spring, entrepreneur, venture capitalist, engineer, father, Kotlin fan, AI researcher, and musician, about this, that, and everything in between, fresh off our recent SpringOne presentation o...

7.1AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/08/30 12:0 a.m.10 views

A Bootiful Podcast: Tanzu's Cloud and Spring legend Chris Sterling

Hi, Spring fans! In this installment I talk to the Tanzu legend Chris Sterling, who works on making Spring an even more valuable part of a platform. This episode was recorded live at the epic SpringOne 2024 event!...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/07/18 12:0 a.m.10 views

A Bootiful Podcast: Digital Accessibility Architect, Java and Groovy legend, Scott Davis

Hi, Spring fans! In this episode I talk to Java ecosystem legend Scott Davis...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/07/11 12:0 a.m.10 views

A Bootiful Podcast: Cloud Native Cora Iberkleid on architecture, Spring Modulith, and more

Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! In today’s episode, I talk to cloud native Cora Iberkleid about the awesome modular sensation that’s sweeping applications, Spring Modulith!...

7.1AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/05/23 12:0 a.m.10 views

Arbitrary File Write Vulnerability in Spring Cloud Data Flow

Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has the ability to receive upload package requests. However, due to improper sanitization for upload path, a malicious user who has access to skipper server api...

8.8CVSS6.9AI score0.17537EPSS
Exploits1
Spring Security Advisories
Spring Security Advisories
added 2024/03/20 12:0 a.m.10 views

Spring Tips: the Exposed ORM for Kotlin

Hi, Spring fans! In this installment we look at the Exposed Object Relational Mapper framework for Kotlin. Kotlin Java JDBC springboot...

7.3AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/02/19 12:0 a.m.10 views

Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticatedAuthentication method. Specifically, an application is vulnerable if: An application...

7.4CVSS7.1AI score0.00682EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/01/30 12:0 a.m.10 views

Spring Tips: easy CQRS with Axon Framework

Hi, Spring fans! In this installment I'm joined by Axon Framework founder Allard Buijze and we look at the new integrations for Spring Boot developers in Axon Framework and AxonIQ Server. Special thanks to AxonIQ for the keynote video replay. Check out for more great stuff! java java21 axon...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/12/28 12:0 a.m.10 views

A Bootiful Podcast: Trifork CTO Joris Kuipers

Hi, Spring fans! In this installment, Josh Long talks to longtime Spring community legend and Trifork CTO Joris Kuipers. Happy new year!...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/12/14 12:0 a.m.10 views

A Bootiful Podcast: Microcks.io contributors Laurent Broudoux and Yacine-Kheddache

Hi, Spring fans! In this installment, I talk about the wide world of AI and then discuss microservice testing with Microcks.io contributors and founders Laurent Broudoux and Yacine-Kheddache. This was recorded live from Devoxx BE 2023!...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/09/07 12:0 a.m.10 views

A Bootiful Podcast: Spring Security lead Rob Winch

Hi, Spring fans! Welcome to another installment of a Bootiful Podcast. In this interview, Josh Long @starbuxman talks to Spring Security legend and lead Rob Winch @robwinch, recorded live from SpringOne 2023!...

6.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/06/08 12:0 a.m.10 views

A Bootiful Podcast: Microsoft’s Sean Li on Azure and Spring Boot

Hi, Spring fans! In this relatively quick installment, recorded live from the lovely Spring I/O 2023, Josh Long talks to Microsoft's Sean Li about some of the latest and greatest in the Azure ecosystem for Spring developers...

6.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/05/09 12:0 a.m.10 views

This Week in Spring - May 9th, 2023

Hi, Spring fans! Welcome to another wonderful, fancyful installment of This Week in Spring! I was just at the first Devoxx GR, in the sunny mediterranean city of Athens, Greece. Uh, yah, this was a good'un. If you can get to it, you should. Don't miss next year's installment if you missed this on...

6.7AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/05/02 12:0 a.m.10 views

This Week in Spring - May 2, 20223

Hi, Spring fans! Welcome to another installment of This Week in Spring! You realize it's already May, 2023? Time's flying, way too quickly! I just got back from Bangalore, India, where I spoke at the amazing Great International Developer Summit, one of the all time best shows ever, and now I'm...

6.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2022/09/19 12:0 a.m.10 views

Potential Unintended Data Exposure for Resource Exposed by Spring Data REST

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

6.5CVSS6.2AI score0.00467EPSS
Exploits0References1
Spring Security Advisories
Spring Security Advisories
added 2022/07/14 1:0 p.m.10 views

A Bootiful Podcast: Nate Schutta: The Thinking Person's Architect, My Friend, and Teammate

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to his friend, teammate, and architect extraordinaire, Nate Schutta @ntschutta...

2.5AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2022/06/20 12:0 a.m.10 views

Spring Data MongoDB SpEL Expression injection vulnerability through annotated repository query methods

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized. Specifically, an application is vulnerable when all of the...

9CVSS7.2AI score0.16771EPSS
Exploits3References1
Spring Security Advisories
Spring Security Advisories
added 2022/05/17 12:0 a.m.10 views

BCrypt skips salt rounds for work factor of 31

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor 31, the encoder does not perform any salt rounds, due to an integer overflow error. The default...

5.3CVSS5.8AI score0.02282EPSS
Exploits0References2
Spring Security Advisories
Spring Security Advisories
added 2018/12/18 12:0 a.m.10 views

Authorization Bypass During JWT Issuer Validation with spring-security

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWT...

7.4CVSS6.1AI score0.00653EPSS
Exploits0References2
Spring Security Advisories
Spring Security Advisories
added 2018/06/14 12:0 a.m.10 views

JSONP enabled by default in MappingJackson2JsonView

Spring Framework, versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions, allows web applications to enable cross-domain requests via JSONP JSON with Padding through AbstractJsonpResponseBodyAdvice for REST controllers, and MappingJackson2JsonView for browse...

7.5CVSS6.6AI score0.03244EPSS
Exploits0References3
Spring Security Advisories
Spring Security Advisories
added 2018/05/09 12:0 a.m.10 views

Unauthorized Access with Spring Security Method Security

Spring Security in combination with Spring Framework 5.0.5.RELEASE contain an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...

8.8CVSS6.8AI score0.02396EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2018/04/30 12:0 a.m.10 views

Issuer validation regression in Spring Cloud SSO Connector

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

8.1CVSS7.8AI score0.01589EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2018/03/16 12:0 a.m.10 views

Spring Batch Admin vulnerable to Cross Site Request Forgery

Spring Batch Admin does not contain Cross Site Request Forgery CSRF protection, which may allow an attacker to craft a malicious site that executes requests to Spring Batch Admin...

8.8CVSS7.9AI score0.0071EPSS
Exploits0References2
Spring Security Advisories
Spring Security Advisories
added 2016/12/21 12:0 a.m.10 views

Directory Traversal in the Spring Framework ResourceServlet

Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks...

7.5CVSS5.3AI score0.0564EPSS
Exploits0References4
Spring Security Advisories
Spring Security Advisories
added 2016/07/07 12:0 a.m.10 views

Spring Security / MVC Path Matching Inconsistency

Both Spring Security and the Spring Framework rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Securit...

7.5CVSS5.4AI score0.02837EPSS
Exploits0References3
Spring Security Advisories
Spring Security Advisories
added 2026/06/10 12:0 a.m.9 views

cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache

cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache...

3.7CVSS6.1AI score0.00223EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/09 12:0 a.m.9 views

cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator...

6.4CVSS6.1AI score0.00206EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/09 12:0 a.m.9 views

cve-2026-41732 - HIGH - In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

cve-2026-41732 - HIGH - In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization...

8.1CVSS6.1AI score0.00347EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/09 12:0 a.m.9 views

cve-2026-41730 - MEDIUM - Spring Data REST exposes persistence-layer internals in error responses

cve-2026-41730 - MEDIUM - Spring Data REST exposes persistence-layer internals in error responses...

5.3CVSS6.1AI score0.00197EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/08 12:0 a.m.9 views

CVE-2026-41842: Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can send malicious requests that are slow to...

7.5CVSS5.3AI score0.00399EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/06/08 12:0 a.m.9 views

cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service

cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service...

5.9CVSS6AI score0.0028EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/05/19 12:0 a.m.9 views

This Week in Spring - May 19th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring!, this one written from the back of a taxi racing to the local Frankfurt train station, where I'll take a train to Munich for the amazing Kotlin Conf 2026 edition, where I'll be part of the keynote and deliver a talk on the...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/05/08 12:0 a.m.9 views

ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

7.5CVSS5.5AI score0.0026EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/30 12:0 a.m.9 views

Ronald Dehuysser, founder of JobRunr, on their ambitious new JavaClaw-like agent runtime

Hi Spring fans! In this installment, I talk to my friend and JobRunr founder Ronald Dehuysser about the latest and greatest, and their new "JavaClaw" project!...

5.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/04/27 12:0 a.m.9 views

OOM by attacker-controlled PDF

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper . Only applications that use ForkPDFLayoutTextStripper and pass user-supplied input to DocumentReader s are affected...

6.5CVSS5.8AI score0.0024EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/27 12:0 a.m.9 views

ONNX model cache defaults to world-writable predictable /tmp directory

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Only applications that use TransformersEmbeddingModel and have the cache enabled, using the default location, are affected...

6.1CVSS5.9AI score0.00105EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/23 12:0 a.m.9 views

Cassandra SSL auto-configuration disables TLS hostname verification

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra...

5CVSS5.8AI score0.00182EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/23 12:0 a.m.9 views

Random value property source uses a weak PRNG unsuitable for secrets

Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range...

4.8CVSS5.8AI score0.00312EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/23 12:0 a.m.9 views

Default security filter chain has no authorization rule with Actuator but without Health

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: If any of the above does not apply, the application is not vulnerable...

9.1CVSS5.8AI score0.00489EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/20 12:0 a.m.9 views

Servlet Path Not Correctly Included in Path Matching of XML Authorization Rules

If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass...

7.5CVSS5.8AI score0.00266EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/20 12:0 a.m.9 views

Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers

If an application is using securityMatchersString and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication,...

7.5CVSS5.9AI score0.00248EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/20 12:0 a.m.9 views

Spring Office Hours Podcast: S5E13 - Community Potluck

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this Potluck episode, Dan and DaShaun open up the floor to the community, answering your questions on Spring Boot, Spring AI, Spring Security, and whatever else is on your mind. Potluck episodes are shaped...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/04/09 12:0 a.m.9 views

Spring Office Hours Podcast: S5E12 - Developer Soft Skills with Arun Gupta

Join Dan Vega and DaShaun Carter for another essential update from the Spring ecosystem. In this episode, the guys are joined by DevRel and Java legend Arun Gupta to discuss a topic often overlooked but vital for career longevity: soft skills for developers. Drawing from his decades of experience...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/04/09 12:0 a.m.9 views

SSL bundle configuration silently bypassed in Spring Cloud Gateway

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle , the configuration was silently ignored and the default SSL configuration was used instead...

7.5CVSS5.8AI score0.00217EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/02 12:0 a.m.9 views

A Bootiful Podcast: Java developer advocate Ana-Maria Mihalceanu

I had a wonderful chat with Java Developer Advocate Ana-Maria Mihalceanu about Java Flight Recorder, Project Babylon, Project Panama, and so many other exciting things in the Java ecosystem...

5.9AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/03/26 12:0 a.m.9 views

RediSearch Query via Unescaped TAG Filter Values in RedisVectorStore

In RedisFilterExpressionConverter of spring-ai-redis-store , when a user-controlled string is passed as a filter value for a TAG field, stringValue inserts the value directly into the @field:VALUE RediSearch TAG block without escaping characters...

7.5CVSS5.8AI score0.0025EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/03/18 12:0 a.m.9 views

Blending Chat with Rich UIs with Spring AI and MCP Apps

The way humans typically interact with AI is via a chat-style interface such as ChatGPT or Claude Desktop. In fact, the ability to converse with an AI in natural language is perhaps one of the most amazing things about this technology. It lets humans talk to computers in human terms, rather than...

5.9AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/01/26 12:0 a.m.9 views

This Week in Spring - January 26th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this, I cannot believe we're nearly at the end of the month! Time sure flies. Spring AI 2.0.0-M2 is available now Spring Modulith 2.1 M1, 2.0.2, and 1.4.7 released In last week's installment of A Bootiful Podcast ,...

5.9AI score
Exploits0
Total number of security vulnerabilities935