Most recent entries from all

bdu:2019-01223

cnvd-2018-07295

EUVD-2026-169182

fkie_cve-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

GHSA-p5hg-3xm3-gcjg — Spring Framework allows applications to expose STOMP over WebSocket endpoints

Affected: Maven: org.springframework:spring-messaging

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

gsd-2018-1270

RHSA-2018:2939 — Red Hat Security Advisory: Red Hat FIS 2.0 on Fuse 6.3.0 R8 security and bug fix update

tomcat: Remote Code Execution bypass for CVE-2017-12615 spring-security-oauth: remote code execution in the authorization process spring-framework: Possible RCE via spring messaging spring-framework: Directory traversal vulnerability with static resources on Windows filesystems spring-framework: Address partial fix for CVE-2018-1270 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources tomcat: Late application of security constraints can lead to resource exposure for unauthorised users tomcat: A bug in the UTF-8 decoder can lead to DoS jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries

UBUNTU-CVE-2018-1270

Affected: Ubuntu:18.04:LTS: libspring-java

WID-SEC-W-2024-0528 — Dell Data Protection Advisor: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.