Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

spring framework vulnerabilities and exploits

(subscribe to this query)
5
CVSSv2
CVE-2016-9878
An issue exists in Pivotal Spring Framework prior to 3.2.18, 4.2.x prior to 4.2.9, and 4.3.x prior to 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
Vmware Spring Framework 4.3.1Pivotal Software Spring Framework 4.3.0Vmware Spring Framework 4.2.8Vmware Spring Framework 4.2.1Pivotal Software Spring Framework 4.2.0Vmware Spring Framework 3.2.11Vmware Spring Framework 3.2.10Vmware Spring Framework 3.2.2Vmware Spring Framework 3.2.1Vmware Spring Framework 4.2.7Vmware Spring Framework 4.2.6Vmware Spring Framework 3.2.17Vmware Spring Framework 3.2.16Vmware Spring Framework 3.2.9Vmware Spring Framework 3.2.8Pivotal Software Spring FrameworkVmware Spring Framework 4.3.4Vmware Spring Framework 4.2.5Vmware Spring Framework 4.2.4Vmware Spring Framework 3.2.15Vmware Spring Framework 3.2.14Vmware Spring Framework 3.2.7
6.8
CVSSv2
CVE-2014-0225
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
Vmware Spring Framework 3.1.3Vmware Spring Framework 3.1.4Pivotal Software Spring Framework 3.0.0Vmware Spring Framework 3.0.1Vmware Spring Framework 3.2.1Pivotal Software Spring Framework 3.2.0Pivotal Software Spring Framework 4.0.0Vmware Spring Framework 4.0.1Vmware Spring Framework 3.1.0Vmware Spring Framework 4.0.0Vmware Spring Framework 3.1.1Vmware Spring Framework 3.0.3Vmware Spring Framework 3.0.5Vmware Spring Framework 3.2.4Vmware Spring Framework 3.2.2Vmware Spring Framework 4.0.2Vmware Spring Framework 4.0.4Vmware Spring Framework 3.2.0Vmware Spring Framework 3.0.7Vmware Spring Framework 3.2.8Vmware Spring Framework 3.2.6Vmware Spring Framework 3.2.7
9.3
CVSSv2
CVE-2015-5211
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in th...
Vmware Spring Framework 3.2.2Vmware Spring Framework 3.2.1Vmware Spring Framework 3.2.8Vmware Spring Framework 3.2.7Vmware Spring Framework 3.2.10Vmware Spring Framework 3.2.9Vmware Spring Framework 3.2.4Vmware Spring Framework 3.2.3Vmware Spring Framework 3.2.6Vmware Spring Framework 3.2.5Vmware Spring Framework 4.0.1Vmware Spring Framework 4.0.6Vmware Spring Framework 4.0.8Vmware Spring Framework 3.2.14Vmware Spring Framework 4.2.1Vmware Spring Framework 4.1.6Vmware Spring Framework 4.0.2Vmware Spring Framework 4.0.3Vmware Spring Framework 4.0.4Vmware Spring Framework 4.0.5Vmware Spring Framework 3.2.11Vmware Spring Framework 3.2.12
6.8
CVSSv2
CVE-2013-7315
The Spring MVC in Spring Framework prior to 3.2.4 and 4.0.0.M1 up to and including 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent malicious users to read arbitrary files, cause a denial of service, and conduct CSR...
Vmware Spring Framework 3.1.4Vmware Spring Framework 3.1.3Vmware Spring Framework 4.0.0Springsource Spring Framework 3.0.5Springsource Spring Framework 3.0.0Vmware Spring FrameworkVmware Spring Framework 3.2.2Vmware Spring Framework 3.1.0Vmware Spring Framework 3.0.7Springsource Spring Framework 3.0.2Springsource Spring Framework 3.0.1Springsource Spring Framework 3.0.0.m2Vmware Spring Framework 3.2.1Vmware Spring Framework 3.2.0Vmware Spring Framework 3.0.6Springsource Spring Framework 3.0.0.m1Vmware Spring Framework 3.1.2Vmware Spring Framework 3.1.1Springsource Spring Framework 3.0.4Springsource Spring Framework 3.0.3
7.5
CVSSv2
CVE-2011-2730
VMware SpringSource Spring Framework prior to 2.5.6.SEC03, 2.5.7.SR023, and 3.x prior to 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote malicious users to obtain sensitive information via a (1) name attribute...
Springsource Spring Framework 2.5.0Springsource Spring Framework 2.5.5Springsource Spring Framework 2.5.6Springsource Spring Framework 3.0.4Springsource Spring FrameworkSpringsource Spring Framework 2.5.3Springsource Spring Framework 2.5.4Springsource Spring Framework 3.0.2Springsource Spring Framework 3.0.3Springsource Spring Framework 2.5.1Springsource Spring Framework 2.5.2Springsource Spring Framework 3.0.0Springsource Spring Framework 3.0.1Springsource Spring Framework 2.5.7
6
CVSSv2
CVE-2010-1622
SpringSource Spring Framework 2.5.x prior to 2.5.6.SEC02, 2.5.7 prior to 2.5.7.SR01, and 3.0.x prior to 3.0.3 allows remote malicious users to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Oracle Fusion Middleware 11.1.1.8.0Oracle Fusion Middleware 7.6.2Oracle Fusion Middleware 11.1.1.6.1Springsource Spring Framework 2.5.0Springsource Spring Framework 3.0.1Springsource Spring Framework 2.5.3Springsource Spring Framework 3.0.2Springsource Spring Framework 2.5.5Springsource Spring Framework 2.5.6Springsource Spring Framework 2.5.4Springsource Spring Framework 2.5.2Springsource Spring Framework 2.5.7Springsource Spring Framework 3.0.0Springsource Spring Framework 2.5.1
5
CVSSv2
CVE-2015-0201
The Java SockJS client in Pivotal Spring Framework 4.1.x prior to 4.1.5 generates predictable session ids, which allows remote malicious users to send messages to other sessions via unspecified vectors.
Pivotal Software Spring Framework 4.1.0Vmware Spring Framework 4.1.2Vmware Spring Framework 4.1.4Vmware Spring Framework 4.1.1Vmware Spring Framework 4.1.3
5
CVSSv2
CVE-2014-3625
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 up to and including 3.2.x prior to 3.2.12, 4.0.x prior to 4.0.8, and 4.1.x prior to 4.1.2 allows remote malicious users to read arbitrary files via unspecified vectors, related to static resource handling.
Vmware Spring FrameworkPivotal Software Spring Framework
NA
CVE-2024-22233
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC...
Vmware Spring Framework 6.1.2Vmware Spring Framework 6.0.15
6.8
CVSSv2
CVE-2011-2894
Spring Framework 3.0.0 up to and including 3.0.5, Spring Security 3.0.0 up to and including 3.0.5 and 2.0.0 up to and including 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote malicious users to bypass intended security restricti...
Vmware Spring SecurityVmware Spring Framework
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-47626CVE-2024-3400physicalCVE-2024-31426CVE-2024-22423CVE-2024-22438injectlocal usersCVE-2024-3797
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook