Spring

247 results · Feed

• Medium 6.5
  CVE-2019-3799 Public exploit Scanner template EPSS 85%

  Directory Traversal with spring-cloud-config-server

  Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A mal…

  Spring Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven
  May 6, 2019
• Low 3.5
  CVE-2019-3797

  Additional information exposure with Spring Data JPA derived queries

  This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parame…

  Spring Spring Boot org.springframework.data:spring-data-jpa Maven
  May 6, 2019
• Low 3.8
  CVE-2019-3795

  Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security

  Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest ap…

  Spring Spring Security org.springframework.security:spring-security-core Maven
  Apr 9, 2019
• Medium 6.5
  CVE-2019-3778 Public exploit EPSS 17%

  Open Redirect in spring-security-oauth2

  Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user…

  Spring Spring Security OAuth org.springframework.security.oauth:spring-security-oauth2 org.springframework.security.oauth:spring-security-oauth Maven
  Mar 7, 2019
• Low —
  CVE-2019-3772

  Spring Integration XML External Entity Injection (XXE)

  Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

  Spring Spring Integration org.springframework.integration:spring-integration-ws org.springframework.integration:spring-integration-xml Maven
  Jan 18, 2019
• Low —
  CVE-2019-3774

  Spring Batch XML External Entity Injection (XXE)

  Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

  Spring Spring Batch org.springframework.batch:spring-batch-core Maven
  Jan 18, 2019
• Critical 9.8
  CVE-2019-3773

  Spring Web Services XML External Entity Injection (XXE)

  Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

  Spring Spring Web Services org.springframework.ws:spring-xml org.springframework.ws:spring-ws Maven
  Jan 18, 2019