vmware spring framework vulnerabilities and exploits

(subscribe to this query)

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in th...

Vmware Spring Framework 3.2.0 Vmware Spring Framework 3.2.1 Vmware Spring Framework 3.2.2 Vmware Spring Framework 3.2.3 Vmware Spring Framework 3.2.4 Vmware Spring Framework 3.2.5 Vmware Spring Framework 3.2.6 Vmware Spring Framework 3.2.7 Vmware Spring Framework 3.2.8 Vmware Spring Framework 3.2.9 Vmware Spring Framework 3.2.10 Vmware Spring Framework 3.2.11

2 Github repositories

An issue exists in Pivotal Spring Framework prior to 3.2.18, 4.2.x prior to 4.2.9, and 4.3.x prior to 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

Pivotal Software Spring Framework Pivotal Software Spring Framework 4.2.0 Pivotal Software Spring Framework 4.3.0 Vmware Spring Framework 3.2.1 Vmware Spring Framework 3.2.2 Vmware Spring Framework 3.2.3 Vmware Spring Framework 3.2.4 Vmware Spring Framework 3.2.5 Vmware Spring Framework 3.2.6 Vmware Spring Framework 3.2.7 Vmware Spring Framework 3.2.8 Vmware Spring Framework 3.2.9

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Pivotal Software Spring Framework 3.0.0 Pivotal Software Spring Framework 3.1.0 Pivotal Software Spring Framework 3.2.0 Pivotal Software Spring Framework 4.0.0 Vmware Spring Framework 3.0.1 Vmware Spring Framework 3.0.2 Vmware Spring Framework 3.0.3 Vmware Spring Framework 3.0.4 Vmware Spring Framework 3.0.5 Vmware Spring Framework 3.0.6 Vmware Spring Framework 3.0.7 Vmware Spring Framework 3.1.0

The Spring MVC in Spring Framework prior to 3.2.4 and 4.0.0.M1 up to and including 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent malicious users to read arbitrary files, cause a denial of service, and conduct CSR...

Springsource Spring Framework 3.0.0 Springsource Spring Framework 3.0.0.m1 Springsource Spring Framework 3.0.0.m2 Springsource Spring Framework 3.0.1 Springsource Spring Framework 3.0.2 Springsource Spring Framework 3.0.3 Springsource Spring Framework 3.0.4 Springsource Spring Framework 3.0.5 Vmware Spring Framework Vmware Spring Framework 3.0.6 Vmware Spring Framework 3.0.7 Vmware Spring Framework 3.1.0

The Java SockJS client in Pivotal Spring Framework 4.1.x prior to 4.1.5 generates predictable session ids, which allows remote malicious users to send messages to other sessions via unspecified vectors.

Pivotal Software Spring Framework 4.1.0 Vmware Spring Framework 4.1.1 Vmware Spring Framework 4.1.2 Vmware Spring Framework 4.1.3 Vmware Spring Framework 4.1.4

1 Github repository

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC...

Vmware Spring Framework 6.0.15 Vmware Spring Framework 6.1.2

Spring Framework 3.0.0 up to and including 3.0.5, Spring Security 3.0.0 up to and including 3.0.5 and 2.0.0 up to and including 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote malicious users to bypass intended security restricti...

Vmware Spring Framework Vmware Spring Security

2 Github repositories

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 up to and including 3.2.x prior to 3.2.12, 4.0.x prior to 4.0.8, and 4.1.x prior to 4.1.2 allows remote malicious users to read arbitrary files via unspecified vectors, related to static resource handling.

Pivotal Software Spring Framework Vmware Spring Framework

Spring Security versions 5.1.x before 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fas...

Vmware Spring Framework

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC o...

Vmware Spring Framework

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook