https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:54:16 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-07569 cnvd-2018-07569 https://cve.radiocsirt.org/vuln/cnvd-2018-07569 https://cve.radiocsirt.org/vuln/euvd-2026-181543 EUVD-2026-181543 https://cve.radiocsirt.org/vuln/euvd-2026-181543 https://cve.radiocsirt.org/vuln/fkie_cve-2018-1272 <p>Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.</p> <p>Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-1272 https://cve.radiocsirt.org/vuln/ghsa-4487-x383-qpph <p><strong>Affected:</strong> Maven: org.springframework:spring-core</p> <p>Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.</p> <p><strong>Affected:</strong> Maven: org.springframework:spring-core</p> <p>Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.</p> https://cve.radiocsirt.org/vuln/ghsa-4487-x383-qpph https://cve.radiocsirt.org/vuln/gsd-2018-1272 gsd-2018-1272 https://cve.radiocsirt.org/vuln/gsd-2018-1272 https://cve.radiocsirt.org/vuln/rhsa-2018:1320 <p>spring-framework: Directory traversal vulnerability with static resources on Windows filesystems spring-framework: Multipart content pollution spring-framework: Address partial fix for CVE-2018-1270 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources tomcat: Late application of security constraints can lead to resource exposure for unauthorised users</p> <p>spring-framework: Directory traversal vulnerability with static resources on Windows filesystems spring-framework: Multipart content pollution spring-framework: Address partial fix for CVE-2018-1270 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources tomcat: Late application of security constraints can lead to resource exposure for unauthorised users</p> https://cve.radiocsirt.org/vuln/rhsa-2018:1320 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0528 <p>Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0528