Most recent entries from all

EUVD-2026-166122

fkie_cve-2019-3797

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

GHSA-jgmr-wrwx-mgfj — Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA

Affected: Maven: org.springframework.data:spring-data-jpa

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

gsd-2019-3797

RHSA-2020:3192 — Red Hat Security Advisory: Red Hat Fuse 7.7.0 release and security update

netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl elasticsearch: Information exposure via _cluster/settings API pdfbox: unbounded computation in parser resulting in a denial of service vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. spring-data-jpa: Additional information exposure with Spring Data JPA derived queries HTTP/2: large amount of data requests leads to denial of service hawtio: server side request forgery via initial /proxy/ substring of a URI apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default jackson-mapper-asl: XML external entity similar to CVE-2016-3720 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source cxf: OpenId Connect token service does not properly validate the clientId jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS jackson-databind: Serialization gadgets in classes of the commons-configuration package jackson-databind: Serialization gadgets in clas…