Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.springframework/spring-core@3.0-alpha0
Typemaven
Namespaceorg.springframework
Namespring-core
Version3.0-alpha0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.0.1.RELEASE
Latest_non_vulnerable_version6.2.11
Affected_by_vulnerabilities
0
url VCID-hcrz-cwpf-37db
vulnerability_id VCID-hcrz-cwpf-37db
summary 
EL expressions double evaluation
When a container supports Expression Language (EL), this package evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a name attribute in a `spring:hasBindErrors` tag; path attribute in a `spring:bind` or `spring:nestedpath` tag; `arguments`, `code`, `text`, `var`, `scope`, or `message` attribute in a `spring:message` or `spring:theme` tag; or `var`, `scope`, or `value` attribute in a `spring:transform` tag, aka Expression Language Injection.
references
0
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2730
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2730
1
reference_url http://support.springsource.com/security/cve-2011-2730
reference_id CVE-2011-2730
reference_type
scores
url http://support.springsource.com/security/cve-2011-2730
fixed_packages
0
url pkg:maven/org.springframework/spring-core@3.0.6.RELEASE
purl pkg:maven/org.springframework/spring-core@3.0.6.RELEASE
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@3.0.6.RELEASE
aliases CVE-2011-2730
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hcrz-cwpf-37db
1
url VCID-nsks-myf2-fugq
vulnerability_id VCID-nsks-myf2-fugq
summary 
Regular expression denial of service (ReDOS)
Algorithmic complexity vulnerability in this package allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.
references
0
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1190
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1190
1
reference_url http://support.springsource.com/security/cve-2009-1190
reference_id CVE-2009-1190
reference_type
scores
url http://support.springsource.com/security/cve-2009-1190
fixed_packages
0
url pkg:maven/org.springframework/spring-core@3.0.1.RELEASE
purl pkg:maven/org.springframework/spring-core@3.0.1.RELEASE
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@3.0.1.RELEASE
aliases CVE-2009-1190
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nsks-myf2-fugq
2
url VCID-p6yn-xbh2-3fhk
vulnerability_id VCID-p6yn-xbh2-3fhk
summary 
Remote classloader modification
This package allows remote attackers to execute arbitrary code via an HTTP request containing `class.classLoader.URLs[0]=jar:` followed by a URL of a crafted `.jar` file.
references
0
reference_url http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
reference_id
reference_type
scores
url http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
1
reference_url http://geronimo.apache.org/21x-security-report.html
reference_id
reference_type
scores
url http://geronimo.apache.org/21x-security-report.html
2
reference_url http://geronimo.apache.org/22x-security-report.html
reference_id
reference_type
scores
url http://geronimo.apache.org/22x-security-report.html
3
reference_url https://seclists.org/fulldisclosure/2010/Jun/456
reference_id
reference_type
scores
url https://seclists.org/fulldisclosure/2010/Jun/456
4
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1622
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1622
5
reference_url http://www.exploit-db.com/exploits/13918
reference_id
reference_type
scores
url http://www.exploit-db.com/exploits/13918
6
reference_url http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
reference_id
reference_type
scores
url http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2010-1622
reference_id CVE-2010-1622
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2010-1622
8
reference_url http://support.springsource.com/security/cve-2010-1622
reference_id CVE-2010-1622
reference_type
scores
url http://support.springsource.com/security/cve-2010-1622
9
reference_url https://github.com/advisories/GHSA-vpr3-f594-mg5g
reference_id GHSA-vpr3-f594-mg5g
reference_type
scores
url https://github.com/advisories/GHSA-vpr3-f594-mg5g
fixed_packages
0
url pkg:maven/org.springframework/spring-core@3.0.3.RELEASE
purl pkg:maven/org.springframework/spring-core@3.0.3.RELEASE
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@3.0.3.RELEASE
aliases CVE-2010-1622, GHSA-vpr3-f594-mg5g
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p6yn-xbh2-3fhk
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@3.0-alpha0