Search for packages
| purl | pkg:maven/org.springframework/spring-webmvc@5.0.3.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2020-5397
|
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1271
|
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-36p3-wjmg-h94x
Aliases: CVE-2022-22965 |
Remote Code Execution in Spring Framework Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability … |
Vulnerable |
|
GHSA-8wx2-9q48-vm9r
Aliases: CVE-2020-5398 |
RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application In Spring Framework, versions … |
Vulnerable |
|
CVE-2020-5421
|
Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-15756
|
Uncontrolled Resource Consumption Spring Framework provides support for range requests when serving static resources through the `ResourceHttpRequestHandler`. A malicious user … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-5398
|
Download of Code Without Integrity Check In Spring Framework, an application is vulnerable to a reflected file download (RFD) attack … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1272
|
Improper Privilege Management When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and … |
Vulnerable Vulnerable |
|
CVE-2018-1271
|
Path Traversal Spring Framework allows applications to configure Spring MVC to serve static resources (e.g., CSS, JS, images). When static … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-g5vr-rgqm-vf78
Aliases: CVE-2024-38819 |
Spring Framework Path Traversal vulnerability Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to … | There are no reported fixed by versions. |
|
GHSA-wg35-8jpf-2xv3
Aliases: CVE-2026-22741 |
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-6p4f-wcwh-5vvm
Aliases: CVE-2026-22745 |
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application … |
Vulnerable Vulnerable |
|
GHSA-957g-f97v-vppc
Aliases: CVE-2026-41846 |
Spring Framework Cross-site Scripting via JSP Form Tags Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or … |
Vulnerable Vulnerable |
|
GHSA-h3qp-gqrc-q736
Aliases: CVE-2026-41844 |
Spring Framework Open Redirect in Spring MVC and WebFlux A Spring MVC or Spring WebFlux application which configures a mapping … |
Vulnerable Vulnerable |
|
GHSA-mq64-j8f9-9gcj
Aliases: CVE-2026-41841 |
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable … |
Vulnerable Vulnerable |
|
GHSA-72pg-x5f8-j25j
Aliases: CVE-2026-41843 |
Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable … |
Vulnerable Vulnerable |
|
GHSA-x23c-287f-qqv5
Aliases: CVE-2026-41842 |
Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable … |
Vulnerable Vulnerable |
|
GHSA-cjpg-rgq5-fr37
Aliases: CVE-2026-41853 |
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable to Multipart request … |
Vulnerable Vulnerable |
|
GHSA-3chg-m5w7-qfv5
Aliases: CVE-2026-41845 |
Spring Framework Cross-site Scripting via JavaScriptUtils Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection … |
Vulnerable Vulnerable |
|
GHSA-pc63-qcmh-9cmg
Aliases: CVE-2026-47884 |
Spring Framework Improper Path Limitation in XsltView Use of XsltView in a Spring MVC application can result in SSRF and … | There are no reported fixed by versions. |
|
CVE-2026-47884
Aliases: GHSA-pc63-qcmh-9cmg |
Spring Framework Improper Path Limitation in XsltView Use of XsltView in a Spring MVC application can result in SSRF and … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2014-1904
|
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows … | |
|
CVE-2016-5007
|
Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for … |