Zip Slip Path Traversal

org.springframework.data, spring-data-geode is vulnerable to a Zip Slip Path Traversal. The vulnerability is due to improper validation of file paths during ZIP archive extraction, which allows an attacker to craft a malicious archive containing traversal paths and write files outside the intende...

XML External Entity (XXE) Injection

Apache CXF is vulnerable to an XML External Entity XXE injection. The vulnerability is due to insufficient JAXP hardening of SAXParserFactory configurations, which allows an attacker to exploit external entity resolution to perform out-of-band OOB requests and potentially access sensitive resourc...

Improper Authorization

Apache ActiveMQ is vulnerable to Improper Authorization. The vulnerability is due to misconfigured Jetty settings that fail to restrict /admin/ paths to administrators, where an authenticated low‑privilege Web Console user can access those paths and potentially perform administrative actions...

Memory Allocation With Excessive Size Value

Apache ActiveMQ is vulnerable to Memory Allocation with Excessive Size Value. The vulnerability is due to insufficient validation of the size value in a pre-authentication WireFormatInfo frame, which allows an unauthenticated remote attacker to trigger excessive memory allocation and crash the...

Signature Bypass

Apache CXF is vulnerable to signature Bypass. The vulnerability is due to insufficient verification of metadata signatures, where the JwsJsonContainerRequestFilter processes metadata without confirming it was authenticated by the accepted signature, and attackers can supply unauthenticated...

Path Traversal

Apache IoTDB is vulnerable to Path Traversal. The vulnerability is due to improper limitation of a pathname to a restricted directory, where the application fails to properly validate file path inputs and attackers can supply crafted path sequences to read or write files outside the intended...

Authentication Bypass

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...

Deserialization Of Untrusted Data

Apache Camel PQC Component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to AwsSecretsManagerKeyLifecycleManager.deserializeMetadata deserializing attacker-controlled data with ObjectInputStream.readObject without an ObjectInputFilter or class allow-list, allowing a...

Improper Access Control

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an improper access control. The vulnerability is due to an inverted IP address validation check that rejects legitimate requests from the bound IP address while allowing requests from other IP addresses, which allows an attacker to bypass...

JNDI Injection

Apache CXF is vulnerable to JNDI Injection. The vulnerability is due to insufficient validation of JCA deployment descriptor ra.xml or runtime activation parameters, which allows an attacker who can manipulate these inputs to inject malicious JNDI references and potentially execute arbitrary code...

UnAuthenticated Server-Side Request Forgery (SSRF)

SeaweedFS is vulnerable to an unauthenticated Server-Side Request Forgery SSRF. The vulnerability is due to the VolumeServer.FetchAndWriteNeedle RPC accepting a caller-supplied remote endpoint without authentication or target validation, which allows an attacker to send requests to arbitrary...

XML Entity Expansion

fast-xml-parser is vulnerable to XML Entity Expansion. The vulnerability is due to multiple DOCTYPE declarations repeatedly resetting entity-expansion limits during XML parsing, which allows an attacker to submit crafted XML that causes excessive CPU and memory consumption, event-loop blocking, a...

Sensitive Information Disclosure

Nuxt is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the development server trusting an attacker-controlled Host header when validating local requests, which allows an unauthenticated network attacker to spoof the header and retrieve the project's absolute filesyste...

Cross-Site Scripting (XSS)

Spring Web Flow is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the JavaScript RemotingHandler rendering error-response bodies as HTML even when the response is not text/html, which allows an attacker to exploit the issue by injecting malicious input that is reflected in...

Improper Verification Of Cryptographic Signature

Spring Security is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to SAML Responses and LogoutRequest/LogoutResponse elements being decrypted without requiring a valid signature, which allows an attacker to craft malicious SAML payloads and use the Servic...

Improper Certificate Validation

Spring AMQP is vulnerable to Improper Certificate Validation. The vulnerability is due to TLS connections configured through RabbitConnectionFactoryBean.setUri"amqps://..." lacking certificate and hostname verification unless setUseSSLtrue is explicitly enabled, which allows an attacker to...

Insecure Randomness

Spring AMQP is vulnerable to Predictable Correlation Identifier vulnerability as per NVD Description or CWE-330. The vulnerability is due to correlation IDs for RabbitTemplate.sendAndReceive replies being generated using a predictable internal counter, which allows an attacker to predict...

Improper Certificate Validation

Spring Boot is vulnerable to Improper Certificate Validation. The vulnerability is due to hostname verification being disabled in Mail auto-configuration, which allows an attacker capable of intercepting the SMTP connection to impersonate the intended mail server and potentially access or...

Insecure Temporary File

Spring Boot is vulnerable to Insecure Temporary File. The vulnerability is due to the use of a predictable static directory for the embedded Artemis broker's data, which allows a local attacker to pre-create or replace the directory with a symlink and potentially redirect broker file operations t...

Directory Traversal

Spring Integration is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of file paths received from malicious or compromised FTP/SFTP/SMB servers, which allows an attacker to write arbitrary content to files outside the configured local directory...

Denial Of Service (DoS)

Micrometer is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of specially crafted HTTP requests, which allows an attacker to send malicious requests that consume excessive resources and cause the affected application to become unavailable...

SQL Injection

Spring Data Relational is vulnerable to SQL Injection. The vulnerability is due to insufficient escaping of wildcard characters in user-controlled input, which allows an attacker to inject wildcard patterns and perform boolean-based blind data inference...

Improper Validation Of User-Controlled Retry Header Value

Spring Kafka is vulnerable to improper validation of user-controlled retry header value. The vulnerability is due to insufficient validation of the retrytopic-attempts header, which allows an attacker to craft an out-of-range retry attempt count and cause the retry topic router to incorrectly...

Deserialization Of Untrusted Data

Spring Framework is vulnerable to deserialization of untrusted data. The vulnerability is due to MappingJackson2MessageConverter and JacksonJsonMessageConverter allowing arbitrary class instantiation from untrusted JMS messages, which allows an attacker to exploit gadget classes during...

Denial Of Service

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to specially crafted HTTP requests causing excessive memory allocation when Spring Data Web Support is enabled with a controller method using @ProjectedPayload...

Denial Of Service

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to a StackOverflowException when parsing attacker-controlled Sort parameters, allowing an attacker to exhaust application resources...

Incorrect Authorization

org.springframework.graphql:spring-graphql is vulnerable to Improper Authorization. The vulnerability is due to incorrect resolution of security annotations on @Controller data fetcher methods within type hierarchies, which allows an attacker to bypass authorization checks when security annotatio...

Insecure Trusted-Package Validation

Spring for Apache Pulsar is vulnerable to an insecure trusted-package validation. The vulnerability is due to JsonPulsarHeaderMapper using a prefix-based check for trusted packages and treating an empty trusted-packages configuration as trusting all packages, which allows an attacker to potential...

Open Redirect

Spring Security is vulnerable to Open Redirect. The vulnerability is due to CookieRequestCache and CookieServerRequestCache storing and using an unvalidated absolute URL from a browser cookie as the post-login redirect target, allowing an attacker to redirect users to a malicious destination...

SpEL Injection

Spring Data KeyValue / Spring Data Redis is vulnerable to SpEL Injection. The vulnerability is due to unsanitized Sort input being evaluated by SpelPropertyComparator, allowing an attacker to inject and execute malicious SpEL expressions...

Expression Language Injection

Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...

Deserialization Of Untrusted Data

Spring Security is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to malicious serialized payloads being stored in verificationcredentials or encryptioncredentials by an attacker with write access to the saml2assertingpartymetadata table managed by...

Expression Language (SpEL) Injection

Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...

Unsafe Deserialization

org.springframework.graphql, spring-graphql is vulnerable to Unsafe Deserialization. The vulnerability is due to unsafe deserialization of data when processing paginated GraphQL queries, which allows an attacker to craft a malicious GraphQL request and potentially achieve Remote Code Execution RC...

Denial Of Service

Spring Security is vulnerable to Denial Of Service. The vulnerability is due to an unbounded writer inflating compressed SAML payloads into memory when processing SAML 2.0 Login or Logout requests using the REDIRECT binding, allowing an attacker to exhaust application memory...

Cross Site Scripting

Spring Security is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled values in RelyingPartyRegistration being rendered in HTML forms generated by Spring Security filters, allowing arbitrary code execution in the context of the application...

Deserialization Of Untrusted Data

Spring Statemachine is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Kryo-based persistence backends deserializing persisted state-machine contexts without enforcing a class allowlist, which allows an attacker to provide malicious serialized data and potentially...

Cross-Site WebSocket Hijacking (CSWSH)

Spring for GraphQL is vulnerable to Cross-Site WebSocket Hijacking CSWSH. The vulnerability is due to insufficient protection of WebSocket connections, which allows an attacker to trick an authenticated user into visiting a malicious webpage and execute arbitrary GraphQL operations using the...

Arbitrary Query Execution

Spring AI Vector Stores are vulnerable to Arbitrary Query Execution. The vulnerability is due to insufficient sanitization of special characters in vector store queries, allowing attackers to inject and execute arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB...

Improper Input Validation

Apache ActiveMQ is vulnerable to an Improper Input Validation vulnerability. The vulnerability is due to improper validation of negative content-length values in STOMP requests, which allows a remote unauthenticated attacker with access to an exposed STOMP connector to send malicious body data an...

Denial Of Service (DoS)

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to attacker-supplied strings being permanently retained as internal property-lookup cache keys, allowing repeated requests to exhaust application heap memory...

Denial Of Service (DoS)

org.apache.httpcomponents.core5:httpcore5 is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient limits on the number and length of HTTP headers processed by the HTTP/1.1 message parser, which allows a remote attacker to send oversized or excessive headers and exhaust...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the camel-vertx-http component deserializing attacker-controlled Java objects without an ObjectInputFilter when transferException or allowJavaSerializedObject is enabled, which allows an attacker...

Denial-of-service (DoS)

Spring Cloud Sleuth is vulnerable to a Denial-of-service DoS. The vulnerability is due to specially crafted calls that can trigger a DoS condition when org.springframework.cloud:spring-cloud-sleuth-instrumentation is used with Spring TX instrumentation enabled, allowing an attacker to exploit the...

Insufficient Session Expiration

Apache Camel Keycloak Component is vulnerable to Insufficient Session Expiration. The vulnerability is due to KeycloakSecurityHelper.parseAndVerifyAccessToken omitting the TokenVerifier.ISACTIVE check, allowing expired or not-yet-valid access tokens to pass signature, subject, and issuer validati...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered CometD client-supplied headers being copied directly into the Camel Exchange, which allows an attacker to inject Camel control headers and manipulate downstream producers such as HTTP, file, or JMS...

Denial Of Service (DoS)

Apache ActiveMQ is vulnerable to a Memory Allocation with Excessive Size Value vulnerability. The vulnerability is due to improper handling of non-terminating STOMP header bytes, which allows an unauthenticated attacker to send an excessive amount of header data over a STOMP NIO connection, causi...

Input Validation Vulnerability

Apache Camel Mail Component is vulnerable to Improper Input Validation and Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to the MailProducer accepting attacker-controlled mail.smtp. and mail.smtps. headers, allowing untrusted input to override mail session...

Memory Allocation With Excessive Size Value

Apache ActiveMQ is vulnerable to Memory Allocation with Excessive Size Value. The vulnerability is due to improper validation of the encoded size of OpenWire message property maps during unmarshaling, which allows an authenticated attacker to send a crafted message with an excessively large size...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered operationName and operationNamespace headers from inbound HTTP requests, which allows an attacker to control the SOAP operation invoked by the CXF producer and potentially trigger unintended or...