Archive
6 May 2019
Vulnerabilities first published on this day (UTC), newest first.
47 results · Feed
-
Medium 6.5
Directory Traversal with spring-cloud-config-server
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A mal…
-
Low 3.5
Additional information exposure with Spring Data JPA derived queries
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parame…
-
Unscored —
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a …
-
Unscored —
C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown t…
-
Unscored —
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers …
-
Unscored —
Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a re…
-
High 7.5
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of servi…