Spring Framework, versions 5.0 before 5.0.5 and versions 4.3 before 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
vmware spring framework |
||
oracle primavera gateway 16.2 |
||
oracle primavera gateway 15.2 |
||
oracle application testing suite 12.5.0.3 |
||
oracle retail open commerce platform 6.0.1 |
||
oracle application testing suite 13.1.0.1 |
||
oracle application testing suite 13.2.0.1 |
||
oracle application testing suite 13.3.0.1 |
||
oracle communications diameter signaling router |
||
oracle communications performance intelligence center |
||
oracle insurance rules palette 10.0 |
||
oracle insurance rules palette 10.2 |
||
oracle communications services gatekeeper |
||
oracle health sciences information manager 3.0 |
||
oracle healthcare master person index 3.0 |
||
oracle healthcare master person index 4.0 |
||
oracle insurance calculation engine 10.2 |
||
oracle retail customer insights 15.0 |
||
oracle retail customer insights 16.0 |
||
oracle tape library acsls 8.4 |
||
oracle communications converged application server |
||
oracle service architecture leveraging tuxedo 12.1.3.0.0 |
||
oracle service architecture leveraging tuxedo 12.2.2.0.0 |
||
oracle retail predictive application server 14.0 |
||
oracle retail predictive application server 14.1 |
||
oracle retail predictive application server 15.0 |
||
oracle retail predictive application server 16.0 |
||
oracle retail order broker 5.1 |
||
oracle retail order broker 5.2 |
||
oracle retail order broker 15.0 |
||
oracle retail order broker 16.0 |
||
oracle retail open commerce platform 5.3.0 |
||
oracle retail open commerce platform 6.0.0 |
||
oracle insurance calculation engine 10.2.1 |
||
oracle insurance calculation engine 10.1.1 |
||
oracle insurance rules palette 10.1 |
||
oracle insurance rules palette 11.0 |
||
oracle insurance rules palette 11.1 |
||
oracle primavera gateway 17.12 |
||
oracle big data discovery 1.6.0 |
||
oracle goldengate for big data 12.2.0.1 |
||
oracle goldengate for big data 12.3.1.1 |
||
oracle goldengate for big data 12.3.2.1 |
Out of 284 flaws, 33 are rated critical. Big Red admins have big patches ahead Thought Patch Tuesday was a load? You gotta check out this Oracle mega-advisory, then
Oracle admins, here's your first critical patch advisory for 2019, and it's a doozy: a total of 284 vulnerabilities patched across Big Red's product range, and 33 of them are rated “critical”. We hope your support contracts are up-to-date to receive these fixes. The full list is here, and with so much to choose from, The Register will work through the top-rated bugs. Oracle Communications Applications (OCA) is home to nine of the vulnerabilities in various components: Oracle E-Business' Perf...
Vulmon