Search for packages
| purl | pkg:maven/org.springframework/spring-core@2.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-1272
|
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-22971
Aliases: GHSA-rqph-vqwm-22vc |
Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, application … |
Vulnerable Vulnerable |
|
CVE-2010-1622
|
Remote classloader modification This package allows remote attackers to execute arbitrary code via an HTTP request containing `class.classLoader.URLs[0]=jar:` followed by … |
Vulnerable Vulnerable |
|
CVE-2023-20861
Aliases: GHSA-564r-hj7v-mcr5 |
Spring Framework vulnerable to denial of service via specially crafted SpEL expression In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2009-1190
|
Regular expression denial of service (ReDOS) Algorithmic complexity vulnerability in this package allows remote attackers to cause a denial of … |
Vulnerable Vulnerable |
|
CVE-2020-5421
|
Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-22970
Aliases: GHSA-hh26-6xwr-ggv7 |
Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, applications … |
Vulnerable Vulnerable |
|
CVE-2022-22968
Aliases: GHSA-g5mm-vmx4-3rg7 |
Improper Handling of Case Sensitivity In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the … |
Vulnerable |
|
CVE-2011-2730
|
EL expressions double evaluation When a container supports Expression Language (EL), this package evaluates EL expressions in tags twice, which … |
Vulnerable Vulnerable |
|
GHSA-pgf9-h69p-pcgf
Aliases: CVE-2015-5211 |
Files or Directories Accessible to External Parties in org.springframework:spring-core Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to … | There are no reported fixed by versions. |
|
GHSA-g8hw-794c-4j9g
Aliases: CVE-2018-1271 |
Path Traversal in org.springframework:spring-core Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported … | There are no reported fixed by versions. |
|
GHSA-rcpf-vj53-7h2m
Aliases: CVE-2018-1257 |
Denial of Service in org.springframework:spring-core Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported … | There are no reported fixed by versions. |
|
GHSA-8crv-49fr-2h6j
Aliases: CVE-2016-5007 |
Spring Security and Spring Framework may not recognize certain paths that should be protected Both Spring Security 3.2.x, 4.0.x, 4.1.0 … | There are no reported fixed by versions. |
|
GHSA-4487-x383-qpph
Aliases: CVE-2018-1272 |
Possible privilege escalation in org.springframework:spring-core Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older … | There are no reported fixed by versions. |
|
CVE-2023-20863
Aliases: GHSA-wxqc-pxw9-g2p8 |
Spring Framework vulnerable to denial of service In spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2016-9878
Aliases: GHSA-2m8h-fgr8-2q9w |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') An issue was discovered in Pivotal Spring Framework before … | There are no reported fixed by versions. |
|
CVE-2016-5007
|
Spring Security / MVC Path Matching Inconsistency This package rely on URL pattern mappings for authorization and for mapping requests … |
Vulnerable Vulnerable |
|
CVE-2015-3192
Aliases: GHSA-6v7w-535j-rq5m |
Improper Restriction of Operations within the Bounds of a Memory Buffer Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 … | There are no reported fixed by versions. |
|
CVE-2018-1275
Aliases: GHSA-3rmv-2pg5-xvqj |
Improper Control of Generation of Code ('Code Injection') Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to … | There are no reported fixed by versions. |
|
GMS-2022-559
Aliases: CVE-2022-22965 GHSA-36p3-wjmg-h94x |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core. |
Vulnerable Vulnerable |
|
GHSA-wv88-pf73-x22p
Aliases: CVE-2011-2730 |
Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x … |
Vulnerable Vulnerable |
|
GHSA-wjjr-h4wh-w6vv
Aliases: CVE-2009-1190 |
Spring Framework Inefficient Regular Expression Complexity Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before … |
Vulnerable Vulnerable |
|
GHSA-659m-px2c-25wj
Aliases: CVE-2026-41848 |
Spring Framework Denial of Service via AntPathMatcher Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack … |
Not vulnerable Not vulnerable |