Spring Framework Security Vulnerabilities and Issues — Spring Framework CVE List

Lucene search

Pivotal SoftwareSpring Framework

3 matches found

CVE•added 2014/01/26 4:58 p.m.•131 views

CVE-2013-6429

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External E...

6.8CVSS5.7AI score0.84056EPSS

CVE•added 2014/11/20 5:50 p.m.•88 views

CVE-2014-3625

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

5CVSS9AI score0.23174EPSS

CVE•added 2014/03/20 4:55 p.m.•71 views

CVE-2014-1904

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

4.3CVSS5.7AI score0.02196EPSS