Most recent entries from all

bdu:2023-06306

certfr-2022-avi-454 — De multiples vulnérabilités ont été découvertes dans VMware Spring. Elles permettent à un attaquant de provoquer un dén…

certfr-2022-avi-454

EUVD-2026-13626

fkie_cve-2022-22971

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

GHSA-rqph-vqwm-22vc — Allocation of Resources Without Limits or Throttling in Spring Framework

Affected: Maven: org.springframework:spring-messaging

gsd-2022-22971

RHSA-2022:5532 — Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update

elasticsearch: not properly preserving security permissions when executing complex queries may lead to information disclosure tomcat: deserialization flaw in session persistence storage leading to RCE junit4: TemporaryFolder is shared between all users across system which could result in information disclosure wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure jackson-databind: denial of service via a large depth of nested objects mysql-connector-java: unauthorized access to critical undertow: potential security issue in flow control over HTTP/2 may lead to DOS wildfly-elytron: possible timing attack in ScramServer wildfly-core: Invalid Sensitivity Classification of Vault Expression nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes undertow: client side invocation timeout raised when calling over HTTP2 kubernetes-client: Insecure deserialization in unmarshalYaml method springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096) springframework: malicious input leads to insertion of additional log entries spring-security: Denial-of-Service (DoS) attack via initiation of Authorization Request protobuf-java: potential DoS in the parsing procedure for binary data google-oauth-client: Token signature not verified tomcat: Inf…

UBUNTU-CVE-2022-22971

Affected: Ubuntu:Pro:14.04:LTS: libspring-java, Ubuntu:Pro:16.04:LTS: libspring-java, Ubuntu:Pro:18.04:LTS: libspring-java, Ubuntu:Pro:20.04:LTS: libspring-java, Ubuntu:Pro:22.04:LTS: libspring-java, Ubuntu:Pro:24.04:LTS: libspring-java, Ubuntu:25.10: libspring-java, Ubuntu:26.04:LTS: libspring-java

WID-SEC-W-2022-0361 — VMware Tanzu Spring Framework: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um einen Denial of Service Angriff durchzuführen.