CVE-2019-3774

CVE-2019-3774 affects Spring Batch versions 3.0.9, 4.0.1, 4.1.0 and older unsupported versions. It is caused by an XML External Entity (XXE) vulnerability when processing XML data from untrusted sources. Public scoring indicates high severity (CVSS v3 base 9.8; v2 base 7.5). No remediation or fix...

CVE-2020-5411

CVE-2020-5411 affects VMware Spring Batch (and IBM DRM aggregations) where Jackson default typing enables deserialization of untrusted data, potentially allowing arbitrary code execution if a malicious actor can write to the JobRepository data store. Connected advisories confirm the root cause: u...