Latest vmware spring framework Vulnerabilities

● CVE-2024-22233

Spring Framework server Web DoS Vulnerability

maven/org.springframework:spring-core=6.0.15

maven/org.springframework:spring-core=6.1.2

VMware Spring Framework=6.0.15

VMware Spring Framework=6.1.2

● CVE-2023-34053

Spring Framework server Web Observations DoS Vulnerability

VMware Spring Framework>=6.0.0<6.0.14

maven/org.springframework:spring-webmvc>=6.0.0<6.0.14

>=6.0.0<6.0.14

● CVE-2023-20863

A flaw was found in Spring Framework. Certain versions of Spring Framework's Expression Language were not restricting the size of Spring Expressions. This could allow an attacker to craft a malicious ...

VMware Spring Framework>=5.2.0<5.2.24

VMware Spring Framework>=5.3.0<5.3.27

VMware Spring Framework>=6.0.0<6.0.8

IBM Watson Knowledge Catalog on-prem<=4.x

redhat/spring framework<6.0.8

redhat/spring framework<5.3.27

and 4 more

● CVE-2023-20861

A flaw found was found in Spring Framework. This flaw allows a malicious user to use a specially crafted SpEL expression that causes a denial of service (DoS).

redhat/jenkins<0:2.401.1.1686649641-3.el8

redhat/jenkins<0:2.401.1.1686680404-3.el8

redhat/ovirt-dependencies<0:4.5.3-1.el8e

VMware Spring Framework<=5.2.22

VMware Spring Framework>=5.3.0<=5.3.25

VMware Spring Framework>=6.0.0<=6.0.6

and 6 more

● CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spri...

maven/org.springframework:spring>=5.3.0<5.3.26

maven/org.springframework:spring>=6.0.0<6.0.7

redhat/jenkins<0:2.401.1.1686831596-3.el8

redhat/jenkins<0:2.401.1.1686649641-3.el8

redhat/jenkins<0:2.401.1.1686680404-3.el8

redhat/jenkins<0:2.401.1.1685677065-1.el8

and 8 more

● CVE-2022-22970

A flaw was found in Spring Framework. Applications that handle file uploads are vulnerable to a denial of service (DoS) attack if they rely on data binding to set a MultipartFile or javax.servlet.Part...

redhat/springframework<5.3.20

redhat/springframework<5.2.22

maven/org.springframework:spring-beans>=5.3.0<5.3.20

maven/org.springframework:spring-beans<=5.2.21.RELEASE

VMware Spring Framework<=5.2.21

VMware Spring Framework>=5.3.0<=5.3.19

and 8 more

● CVE-2022-22971

A flaw was found in Spring Framework Applications. Applications that use STOMP over the WebSocket endpoint are vulnerable to a denial of service attack caused by an authenticated user.

redhat/springframework<5.3.20

redhat/springframework<5.2.22

maven/org.springframework:spring-messaging<=5.2.21.RELEASE

maven/org.springframework:spring-messaging>=5.3.0<5.3.20

VMware Spring Framework>=5.2.0<=5.2.21

VMware Spring Framework>=5.3.0<=5.3.19

and 4 more

● CVE-2022-22968

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively...

redhat/Spring Framework<5.3.19

redhat/Spring Framework<5.2.21

maven/org.springframework:spring-context<5.2.21

maven/org.springframework:spring-context>=5.3.0<5.3.19

VMware Spring Framework<5.2.0

VMware Spring Framework>=5.2.0<=5.2.20

and 10 more

● CVE-2022-22965

Spring Framework JDK 9+ Remote Code Execution Vulnerability

VMware Spring Framework

VMware Spring Framework<5.2.20

VMware Spring Framework>=5.3.0<5.3.18

Cisco CX Cloud Agent<2.1.0

Oracle Communications Cloud Native Core Automated Test Suite=1.9.0

Oracle Communications Cloud Native Core Automated Test Suite=22.1.0

and 84 more

● CVE-2022-22950

A flaw was found in the Spring Framework. This flaw allows an attacker to craft a special Spring Expression, causing a denial of service.

redhat/ovirt-dependencies<0:4.5.2-1.el8e

VMware Spring Framework<5.2.20

VMware Spring Framework>=5.3.0<5.3.17

● CVE-2021-22060

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This...

VMware Spring Framework>=5.2.0<=5.2.18

VMware Spring Framework>=5.3.0<=5.3.13

Oracle Communications Cloud Native Core Console=1.9.0

Oracle Communications Cloud Native Core Service Communication Proxy=1.15.0

● CVE-2021-22096

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

redhat/ovirt-dependencies<0:4.5.2-1.el8e

VMware Spring Framework>=5.2.0<=5.2.17

VMware Spring Framework>=5.3.0<=5.3.10

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vsphere

Netapp Active Iq Unified Manager Windows

and 6 more

● CVE-2021-22118

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a...

maven/org.springframework:spring-web>=5.3.0<=5.3.6

maven/org.springframework:spring-web>=5.2.0<=5.2.14

IBM DRM<=2.0.6

redhat/spring-framework<5.3.7

redhat/spring-framework<5.2.15

VMware Spring Framework>=5.2.0<5.2.15

and 48 more

● CVE-2020-5421

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depen...

maven/org.springframework:spring-framework-bom<4.3.29

maven/org.springframework:spring-framework-bom>=5.0.0<=5.0.18

maven/org.springframework:spring-framework-bom>=5.1.0<=5.1.17

maven/org.springframework:spring-framework-bom>=5.2.0<=5.2.8

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

redhat/springframework<5.2.9

and 80 more

● CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) e...

maven/org.springframework:spring-webflux>=5.2.0<5.2.3

maven/org.springframework:spring-webmvc>=5.2.0<5.2.3

VMware Spring Framework>=5.2.0<5.2.3

Oracle Application Testing Suite=13.3.0.1

Oracle Communications Brm - Elastic Charging Engine=11.3

Oracle Communications Brm - Elastic Charging Engine=12.0

and 48 more

● CVE-2020-5398

A flaw was found in springframework in versions prior to 5.0.16, 5.1.13, and 5.2.3. A reflected file download (RFD) attack is possible when a "Content-Disposition" header is set in response to where t...

IBM Data Risk Manager<=2.0.6

redhat/springframework<5.2.3

redhat/springframework<5.1.13

redhat/springframework<5.0.16

maven/org.springframework:spring-webflux>=5.0.0.RELEASE<5.0.16.RELEASE

maven/org.springframework:spring-webflux>=5.1.0.RELEASE<5.1.13.RELEASE

and 67 more

● CVE-2016-1000027

Pivota Spring Framework could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw in the library. By sending specially-crafted input, an attacker ...

maven/org.springframework:spring-web<6.0.0

debian/libspring-java

VMware Spring Framework<6.0.0

IBM Cloud Pak for Business Automation<=V23.0.1 - V23.0.1-IF001

IBM Cloud Pak for Business Automation<=V21.0.3 - V21.0.3-IF023

IBM Cloud Pak for Business Automation<=V22.0.2 - V22.0.2-IF006 and later fixes V22.0.1 - V22.0.1-IF006 and later fixes V21.0.2 - V21.0.2-IF012 and later fixes V21.0.1 - V21.0.1-IF007 and later fixes V20.0.1 - V20.0.3 and later fixes V19.0.1 - V19.0.3 and later fixes V18.0.0 - V18.0.2 and later fixes

● CVE-2018-15801

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malic...

VMware Spring Framework>=5.1.0<5.1.2

maven/org.springframework.security:spring-security-oauth2-jose>=5.1.0<5.1.2

maven/org.springframework.security:spring-security-core>=5.1.0<5.1.2

>=5.1.0<5.1.2

● CVE-2018-15756

Pivotal Spring Framework is vulnerable to a denial of service, caused by improper handling of range request by the ResourceHttpRequestHandler. By adding a range header with a high number of ranges, a ...

IBM GDE<=3.0.0.2

redhat/springframework<5.0.10

redhat/springframework<4.3.20

VMware Spring Framework>=4.2.0<4.3.20

VMware Spring Framework>=5.0.0<5.0.10

VMware Spring Framework=5.1.0

and 111 more

● CVE-2018-11040

Pivotal Spring Framework could allow a remote attacker to bypass security restrictions, caused by a flaw in AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView. By sending...

IBM GDE<=3.0.0.2

maven/org.springframework:spring-core>=4.3.0<4.3.18

maven/org.springframework:spring-core>=5.0.0<5.0.7

VMware Spring Framework<4.3.18

VMware Spring Framework>=5.0.0<5.0.7

Oracle Agile Product Lifecycle Management=9.3.3

and 48 more

● CVE-2018-11039

Pivotal Spring Framework is vulnerable to cross-site tracing, caused by a flaw in the HiddenHttpMethodFilter in Spring MVC. By persuading a victim to visit a specially-crafted Web site, an attacker co...

IBM GDE<=3.0.0.2

maven/org.springframework:spring-web>=4.3.0<4.3.18

maven/org.springframework:spring-web>=5.0.0<5.0.7

VMware Spring Framework<4.3.18

VMware Spring Framework>=5.0.0<5.0.7

Oracle Agile PLM=9.3.3

and 61 more

Latest vmware spring framework Vulnerabilities

Company

Resources

Contact