Search for packages
| purl | pkg:maven/org.springframework/spring-webmvc@3.1.4.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2014-3625
|
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2014-1904
|
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2016-9878
|
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-hhm4-hwq6-3c6w
Aliases: CVE-2014-3625 |
Improper Limitation of a Pathname to a Restricted Directory in Spring Framework Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 … | There are no reported fixed by versions. |
|
GHSA-8cmm-qj8g-fcp6
Aliases: CVE-2014-0054 |
Cross-Site Request Forgery in Spring Framework The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 … | There are no reported fixed by versions. |
|
GHSA-36p3-wjmg-h94x
Aliases: CVE-2022-22965 |
Remote Code Execution in Spring Framework Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability … |
Vulnerable |
|
CVE-2014-3625
|
Directory traversal flaw Directory traversal vulnerability in this package allows remote attackers to read arbitrary files via unspecified vectors, related … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2013-6430
|
Possible XSS The `JavaScriptUtils.javaScriptEscape` method in `web/util/JavaScriptUtils.java` in Spring MVC in Spring Framework does not properly escape certain characters, which … |
Vulnerable |
|
CVE-2020-5421
|
Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2014-1904
|
Cross-site scripting flaw Cross-site scripting (XSS) vulnerability in `web/servlet/tags/form/FormTag.java` in Spring MVC in this package allows remote attackers to inject … |
Vulnerable Vulnerable |
|
GHSA-2m8h-fgr8-2q9w
Aliases: CVE-2016-9878 |
Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized An issue was discovered in Pivotal Spring Framework … | There are no reported fixed by versions. |
|
GHSA-f93f-g33r-8pcp
Aliases: CVE-2014-0225 |
Improper Restriction of XML External Entity Reference in Spring Framework When processing user provided XML documents, the Spring Framework 4.0.0 … | There are no reported fixed by versions. |
|
CVE-2016-9878
|
Path Traversal Paths provided to the `ResourceServlet` were not properly sanitized and as a result exposed to directory traversal attacks. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1272
|
Improper Privilege Management When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and … |
Vulnerable Vulnerable |
|
CVE-2018-1271
|
Path Traversal Spring Framework allows applications to configure Spring MVC to serve static resources (e.g., CSS, JS, images). When static … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-ff7p-jqjm-v66h
Aliases: CVE-2014-1904 |
Improper Neutralization of Input During Web Page Generation in Spring Framework Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-g5vr-rgqm-vf78
Aliases: CVE-2024-38819 |
Spring Framework Path Traversal vulnerability Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to … | There are no reported fixed by versions. |
|
GHSA-wg35-8jpf-2xv3
Aliases: CVE-2026-22741 |
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-6p4f-wcwh-5vvm
Aliases: CVE-2026-22745 |
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application … |
Vulnerable Vulnerable |
|
GHSA-957g-f97v-vppc
Aliases: CVE-2026-41846 |
Spring Framework Cross-site Scripting via JSP Form Tags Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or … |
Vulnerable Vulnerable |
|
GHSA-h3qp-gqrc-q736
Aliases: CVE-2026-41844 |
Spring Framework Open Redirect in Spring MVC and WebFlux A Spring MVC or Spring WebFlux application which configures a mapping … |
Vulnerable Vulnerable |
|
GHSA-mq64-j8f9-9gcj
Aliases: CVE-2026-41841 |
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable … |
Vulnerable Vulnerable |
|
GHSA-72pg-x5f8-j25j
Aliases: CVE-2026-41843 |
Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable … |
Vulnerable Vulnerable |
|
GHSA-x23c-287f-qqv5
Aliases: CVE-2026-41842 |
Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable … |
Vulnerable Vulnerable |
|
GHSA-cjpg-rgq5-fr37
Aliases: CVE-2026-41853 |
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable to Multipart request … |
Vulnerable Vulnerable |
|
GHSA-3chg-m5w7-qfv5
Aliases: CVE-2026-41845 |
Spring Framework Cross-site Scripting via JavaScriptUtils Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection … |
Vulnerable Vulnerable |
|
GHSA-pc63-qcmh-9cmg
Aliases: CVE-2026-47884 |
Spring Framework Improper Path Limitation in XsltView Use of XsltView in a Spring MVC application can result in SSRF and … | There are no reported fixed by versions. |
|
CVE-2026-47884
Aliases: GHSA-pc63-qcmh-9cmg |
Spring Framework Improper Path Limitation in XsltView Use of XsltView in a Spring MVC application can result in SSRF and … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2016-5007
|
Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for … |