Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2018-1258

spring-security-core: Unauthorized Access with Spring Security Method Security

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed
Vendors
Netapp Oracle Pivotal Software and 2 more
Products
Oncommand Insight Oncommand Unified Manager Oncommand Workflow Automation and 40 more
CVE-2016-5007

spring: Path matching inconsistency

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

CVSS 3.0 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Pivotal Software Vmware
Products
Spring Framework Spring Framework Spring Security
CVE-2014-0225

Framework: Information disclosure via SSRF

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Pivotal Software Redhat Vmware
Products
Spring Framework Jboss Amq Jboss Fuse and 1 more
CVE-2015-0201

Framework: insufficiently random session ID in Java SockJS client

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 1.9% KEV · Not listed
Vendors
Pivotal Software Vmware
Products
Spring Framework Spring Framework
CVE-2015-3192

Framework: denial-of-service attack with XML input

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

CVSS 3.0 · 5.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Pivotal Software Redhat and 1 more
Products
Fedora Spring Framework Jboss Amq and 5 more
CVE-2014-3625

Framework: directory traversal flaw

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CVSS 2.0 · 5.0 Medium EPSS 9.9% KEV · Not listed
Vendors
Pivotal Software Redhat Vmware
Products
Spring Framework Jboss Amq Jboss Bpms and 4 more
CVE-2014-1904

Framework: cross-site scripting flaw when using Spring MVC

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

CVSS 2.0 · 4.3 Medium EPSS 6.9% KEV · Not listed
Vendors
Pivotal Software Redhat
Products
Spring Framework Jboss Amq Jboss Fuse
CVE-2016-9878

Framework: Directory Traversal in the Spring Framework ResourceServlet

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

CVSS 3.0 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Pivotal Software Redhat Vmware
Products
Spring Framework Jboss Amq Jboss Fuse and 1 more
CVE-2013-6429

Framework: XML External Entity (XXE) injection flaw

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.

CVSS 2.0 · 6.8 Medium EPSS 90.6% KEV · Not listed
Vendors
Pivotal Software Redhat Vmware
Products
Spring Framework Jboss Amq Jboss Fuse and 1 more
CVE-2013-6430

Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

CVSS 3.1 · 5.4 Medium EPSS 1.8% KEV · Not listed
Vendors
Pivotal Software Redhat
Products
Spring Framework Jboss Amq Jboss Fuse