Vendor

Spring by VMware

10 known vulnerabilities.

Products

Spring Security 2 Spring Cloud Config 2 Spring Cloud Task 1 Spring Cloud Netflix 1 Spring Batch 1 Spring Cloud Data Flow 1 Spring Integration 1 Spring Framework 1

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

Medium 5.1

CVE-2020-5428

Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query

In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer.

Spring by VMware Spring Cloud Task org.springframework.cloud:spring-cloud-task-dependencies Maven

Jan 27, 2021
Medium 5.7

CVE-2020-5427

Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query

In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when requesting task execution.

Spring by VMware Spring Cloud Data Flow

Jan 27, 2021
Medium 6.5

CVE-2020-5412 EPSS 10%

Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboa…

Spring by VMware Spring Cloud Netflix org.springframework.cloud:spring-cloud-netflix Maven

Aug 7, 2020
Medium 6.5

CVE-2020-5408

Dictionary attack with Spring Security queryable text encryptor

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious…

Spring by VMware Spring Security org.springframework.security:spring-security-core Maven

May 14, 2020
Medium 6.5

CVE-2020-5405 Public exploit EPSS 69%

Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send …

Spring by VMware Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven

Mar 5, 2020