{"url":"http://public2.vulnerablecode.io/api/packages/51147?format=json","purl":"pkg:maven/org.springframework/spring-core@3.0-alpha0","type":"maven","namespace":"org.springframework","name":"spring-core","version":"3.0-alpha0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"3.0.1.RELEASE","latest_non_vulnerable_version":"6.2.11","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37471?format=json","vulnerability_id":"VCID-hcrz-cwpf-37db","summary":"EL expressions double evaluation\nWhen a container supports Expression Language (EL), this package evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a name attribute in a `spring:hasBindErrors` tag; path attribute in a `spring:bind` or `spring:nestedpath` tag; `arguments`, `code`, `text`, `var`, `scope`, or `message` attribute in a `spring:message` or `spring:theme` tag; or `var`, `scope`, or `value` attribute in a `spring:transform` tag, aka Expression Language Injection.","references":[{"reference_url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2730","reference_id":"","reference_type":"","scores":[],"url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2730"},{"reference_url":"http://support.springsource.com/security/cve-2011-2730","reference_id":"CVE-2011-2730","reference_type":"","scores":[],"url":"http://support.springsource.com/security/cve-2011-2730"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51337?format=json","purl":"pkg:maven/org.springframework/spring-core@3.0.6.RELEASE","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@3.0.6.RELEASE"}],"aliases":["CVE-2011-2730"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hcrz-cwpf-37db"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37375?format=json","vulnerability_id":"VCID-nsks-myf2-fugq","summary":"Regular expression denial of service (ReDOS)\nAlgorithmic complexity vulnerability in this package allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.","references":[{"reference_url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1190","reference_id":"","reference_type":"","scores":[],"url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1190"},{"reference_url":"http://support.springsource.com/security/cve-2009-1190","reference_id":"CVE-2009-1190","reference_type":"","scores":[],"url":"http://support.springsource.com/security/cve-2009-1190"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51150?format=json","purl":"pkg:maven/org.springframework/spring-core@3.0.1.RELEASE","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@3.0.1.RELEASE"}],"aliases":["CVE-2009-1190"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nsks-myf2-fugq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37389?format=json","vulnerability_id":"VCID-p6yn-xbh2-3fhk","summary":"Remote classloader modification\nThis package allows remote attackers to execute arbitrary code via an HTTP request containing `class.classLoader.URLs[0]=jar:` followed by a URL of a crafted `.jar` file.","references":[{"reference_url":"http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html","reference_id":"","reference_type":"","scores":[],"url":"http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html"},{"reference_url":"http://geronimo.apache.org/21x-security-report.html","reference_id":"","reference_type":"","scores":[],"url":"http://geronimo.apache.org/21x-security-report.html"},{"reference_url":"http://geronimo.apache.org/22x-security-report.html","reference_id":"","reference_type":"","scores":[],"url":"http://geronimo.apache.org/22x-security-report.html"},{"reference_url":"https://seclists.org/fulldisclosure/2010/Jun/456","reference_id":"","reference_type":"","scores":[],"url":"https://seclists.org/fulldisclosure/2010/Jun/456"},{"reference_url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1622","reference_id":"","reference_type":"","scores":[],"url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1622"},{"reference_url":"http://www.exploit-db.com/exploits/13918","reference_id":"","reference_type":"","scores":[],"url":"http://www.exploit-db.com/exploits/13918"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1622","reference_id":"CVE-2010-1622","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1622"},{"reference_url":"http://support.springsource.com/security/cve-2010-1622","reference_id":"CVE-2010-1622","reference_type":"","scores":[],"url":"http://support.springsource.com/security/cve-2010-1622"},{"reference_url":"https://github.com/advisories/GHSA-vpr3-f594-mg5g","reference_id":"GHSA-vpr3-f594-mg5g","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-vpr3-f594-mg5g"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51169?format=json","purl":"pkg:maven/org.springframework/spring-core@3.0.3.RELEASE","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@3.0.3.RELEASE"}],"aliases":["CVE-2010-1622","GHSA-vpr3-f594-mg5g"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p6yn-xbh2-3fhk"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-core@3.0-alpha0"}