Search for packages
| purl | pkg:maven/org.springframework/spring-websocket@4.1.2.RELEASE |
| Next non-vulnerable version | 4.1.8.RELEASE |
| Latest non-vulnerable version | 6.2.12 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6zda-pv5y-uybt
Aliases: CVE-2015-0201 GHSA-45vg-2v73-vm62 |
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors. |
Affected by 1 other vulnerability. |
|
VCID-ec6g-dnjb-vycb
Aliases: CVE-2015-5211 GHSA-pgf9-h69p-pcgf |
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||