Search for packages
| purl | pkg:maven/org.springframework/spring-core@5.1.13.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2022-22971
Aliases: GHSA-rqph-vqwm-22vc |
Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, application … |
Vulnerable Vulnerable |
|
CVE-2023-20861
Aliases: GHSA-564r-hj7v-mcr5 |
Spring Framework vulnerable to denial of service via specially crafted SpEL expression In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-5421
|
Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-22970
Aliases: GHSA-hh26-6xwr-ggv7 |
Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, applications … |
Vulnerable Vulnerable |
|
CVE-2022-22968
Aliases: GHSA-g5mm-vmx4-3rg7 |
Improper Handling of Case Sensitivity In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the … |
Vulnerable |
|
CVE-2023-20863
Aliases: GHSA-wxqc-pxw9-g2p8 |
Spring Framework vulnerable to denial of service In spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GMS-2022-559
Aliases: CVE-2022-22965 GHSA-36p3-wjmg-h94x |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core. |
Vulnerable Vulnerable |
|
GHSA-659m-px2c-25wj
Aliases: CVE-2026-41848 |
Spring Framework Denial of Service via AntPathMatcher Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack … |
Not vulnerable Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2015-0201
|
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to … | |
|
CVE-2013-6429
|
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, … | |
|
CVE-2018-1272
|
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support … |