Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2009-1190

Spring Framework Remote Denial of Service vulnerability

Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed
Vendors
Springsource Sun
Products
Dm Server Spring Framework Jdk
CVE-2014-0054

Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

CVSS 2.0 · 6.8 Medium EPSS 91.4% KEV · Not listed
Vendors
Redhat Springsource Vmware
Products
Jboss Amq Jboss Fuse Spring Framework and 1 more
CVE-2010-1622

3.0.3): Arbitrary Java code execution via an HTTP request containing a specially-crafted .jar file

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

CVSS 2.0 · 6.0 Medium EPSS 52.0% KEV · Not listed
Vendors
Oracle Redhat Springsource
Products
Fusion Middleware Jboss Web Framework Kit Spring Framework
CVE-2011-2730

Framework: Information (internal server information, classpath, local working directories, session IDs) disclosure

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

CVSS 2.0 · 7.5 High EPSS 11.8% KEV · Not listed
Vendors
Redhat Springsource
Products
Jboss Enterprise Application Platform Jboss Enterprise Brms Platform Jboss Enterprise Portal Platform and 3 more
CVE-2013-4152

Framework: XML External Entity (XXE) injection flaw

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

CVSS 2.0 · 6.8 Medium EPSS 25.6% KEV · Not listed
Vendors
Redhat Springsource Vmware
Products
Jboss Amq Jboss Enterprise Soa Platform Jboss Fuse and 3 more
CVE-2013-7315

Framework: XML External Entity (XXE) injection flaw

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.

CVSS 2.0 · 6.8 Medium EPSS 5.1% KEV · Not listed
Vendors
Springsource Vmware
Products
Spring Framework Spring Framework