https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:28:18 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-02695 bdu:2020-02695 https://cve.radiocsirt.org/vuln/bdu:2020-02695 https://cve.radiocsirt.org/vuln/certfr-2020-avi-435 certfr-2020-avi-435 https://cve.radiocsirt.org/vuln/certfr-2020-avi-435 https://cve.radiocsirt.org/vuln/cnvd-2020-03855 cnvd-2020-03855 https://cve.radiocsirt.org/vuln/cnvd-2020-03855 https://cve.radiocsirt.org/vuln/euvd-2026-166511 EUVD-2026-166511 https://cve.radiocsirt.org/vuln/euvd-2026-166511 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5398 <p>In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a &#34;Content-Disposition&#34; header in the response where the filename attribute is derived from user supplied input.</p> <p>In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a &#34;Content-Disposition&#34; header in the response where the filename attribute is derived from user supplied input.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-5398 https://cve.radiocsirt.org/vuln/ghsa-8wx2-9q48-vm9r <p><strong>Affected:</strong> Maven: org.springframework:spring-webmvc, Maven: org.springframework:spring-webflux</p> <p>In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a &#34;Content-Disposition&#34; header in the response where the filename attribute is derived from user supplied input.</p> <p><strong>Affected:</strong> Maven: org.springframework:spring-webmvc, Maven: org.springframework:spring-webflux</p> <p>In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a &#34;Content-Disposition&#34; header in the response where the filename attribute is derived from user supplied input.</p> https://cve.radiocsirt.org/vuln/ghsa-8wx2-9q48-vm9r https://cve.radiocsirt.org/vuln/gsd-2020-5398 gsd-2020-5398 https://cve.radiocsirt.org/vuln/gsd-2020-5398 https://cve.radiocsirt.org/vuln/rhsa-2020:5568 <p>jackson-modules-java8: DoS due to an Improper Input Validation thrift: Endless loop when feed with specific input data thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol mysql-connector-java: privilege escalation in MySQL connector spring-ws: XML External Entity Injection (XXE) when receiving XML data from untrusted sources spring-batch: XML External Entity Injection (XXE) when receiving XML data from untrusted sources codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities hibernate-validator: safeHTML validator allows XSS AngularJS: Prototype pollution in merge function could result in code injection org.eclipse.paho.client.mqttv3: Improper hostname validation in the MQTT library cxf: does not restrict the number of message attachments cxf: OpenId Connect token service does not properly validate the clientId libquartz: XXE attacks via job description hibernate: SQL injection issue in Hibernate ORM batik: SSRF via &#34;xlink:href&#34; jetty: double release of resource can lead to information disclosure Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain tika: excessive memory usage in PSDParser apache-flink: JMX information disclosure vulnerability springframework: RFD attack via Content-Dispos…</p> <p>jackson-modules-java8: DoS due to an Improper Input Validation thrift: Endless loop when feed with specific input data thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol mysql-connector-java: privilege escalation in MySQL connector spring-ws: XML External Entity Injection (XXE) when receiving XML data from untrusted sources spring-batch: XML External Entity Injection (XXE) when receiving XML data from untrusted sources codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities hibernate-validator: safeHTML validator allows XSS AngularJS: Prototype pollution in merge function could result in code injection org.eclipse.paho.client.mqttv3: Improper hostname validation in the MQTT library cxf: does not restrict the number of message attachments cxf: OpenId Connect token service does not properly validate the clientId libquartz: XXE attacks via job description hibernate: SQL injection issue in Hibernate ORM batik: SSRF via &#34;xlink:href&#34; jetty: double release of resource can lead to information disclosure Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain tika: excessive memory usage in PSDParser apache-flink: JMX information disclosure vulnerability springframework: RFD attack via Content-Dispos…</p> https://cve.radiocsirt.org/vuln/rhsa-2020:5568 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-5398 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libspring-java, Ubuntu:Pro:16.04:LTS: libspring-java, Ubuntu:Pro:18.04:LTS: libspring-java, Ubuntu:Pro:20.04:LTS: libspring-java, Ubuntu:Pro:22.04:LTS: libspring-java, Ubuntu:Pro:24.04:LTS: libspring-java, Ubuntu:25.10: libspring-java, Ubuntu:26.04:LTS: libspring-java</p> <p>In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a &#34;Content-Disposition&#34; header in the response where the filename attribute is derived from user supplied input.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: libspring-java, Ubuntu:Pro:16.04:LTS: libspring-java, Ubuntu:Pro:18.04:LTS: libspring-java, Ubuntu:Pro:20.04:LTS: libspring-java, Ubuntu:Pro:22.04:LTS: libspring-java, Ubuntu:Pro:24.04:LTS: libspring-java, Ubuntu:25.10: libspring-java, Ubuntu:26.04:LTS: libspring-java</p> <p>In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a &#34;Content-Disposition&#34; header in the response where the filename attribute is derived from user supplied input.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-5398 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2181 <p>Ein Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2181