Most recent entries from all

bdu:2023-09011

certfr-2023-avi-0980 — De multiples vulnérabilités ont été découvertes dans les produits Spring. Elles permettent…

certfr-2023-avi-0980

EUVD-2026-216532

fkie_cve-2023-34055

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

* the application uses Spring MVC or Spring WebFlux * org.springframework.boot:spring-boot-actuator is on the classpath

GHSA-jjfh-589g-3hjx — Spring Boot Actuator denial of service vulnerability

Affected: Maven: org.springframework.boot:spring-boot-actuator

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

* the application uses Spring MVC or Spring WebFlux * `org.springframework.boot:spring-boot-actuator` is on the classpath

gsd-2023-34055

RHSA-2024:3354 — Red Hat Security Advisory: Red Hat Fuse 7.13.0 release and security update

ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE undertow: OutOfMemoryError due to @MultipartConfig handling JSON-java: parser confusion leads to OOM logback: serialization vulnerability in logback receiver logback: A serialization vulnerability in logback receiver spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service jetty: hpack header values cause denial of service in http/2 jetty: Improper addition of quotation marks to user inputs in CgiServlet apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK jetty: Improper validation of HTTP/1 content-length tomcat: HTTP request smuggling via malformed trailer headers shiro: path traversal attack may lead to authentication bypass Solr: Host environment variables are published via the Metrics API undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol tomcat: Leaking of unrelated request bodies in default error page springframework: URL Parsing with Host Validation spring-security: Broken Access Control With Direct Use of AuthenticatedVoter cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding

WID-SEC-W-2023-3009 — VMware Tanzu Spring Framework und Boot: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework und VMware Tanzu Spring Boot ausnutzen, um einen Denial of Service Angriff durchzuführen.