Search for packages
| purl | pkg:maven/org.springframework/spring-core@4.1.1.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2015-0201
|
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1272
|
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-45vg-2v73-vm62
Aliases: CVE-2015-0201 |
Moderate severity vulnerability that affects org.springframework:spring-core The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session … | There are no reported fixed by versions. |
|
CVE-2022-22971
Aliases: GHSA-rqph-vqwm-22vc |
Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, application … |
Vulnerable Vulnerable |
|
CVE-2019-11272
|
Unverified Password Change Spring Security support plain text passwords using `PlaintextPasswordEncoder`. a malicious user (or attacker) can authenticate using a … |
Vulnerable |
|
CVE-2023-20861
Aliases: GHSA-564r-hj7v-mcr5 |
Spring Framework vulnerable to denial of service via specially crafted SpEL expression In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-5421
|
Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-22970
Aliases: GHSA-hh26-6xwr-ggv7 |
Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, applications … |
Vulnerable Vulnerable |
|
CVE-2022-22968
Aliases: GHSA-g5mm-vmx4-3rg7 |
Improper Handling of Case Sensitivity In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the … |
Vulnerable |
|
GHSA-pgf9-h69p-pcgf
Aliases: CVE-2015-5211 |
Files or Directories Accessible to External Parties in org.springframework:spring-core Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to … | There are no reported fixed by versions. |
|
GHSA-g8hw-794c-4j9g
Aliases: CVE-2018-1271 |
Path Traversal in org.springframework:spring-core Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported … | There are no reported fixed by versions. |
|
GHSA-rcpf-vj53-7h2m
Aliases: CVE-2018-1257 |
Denial of Service in org.springframework:spring-core Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported … | There are no reported fixed by versions. |
|
GHSA-8crv-49fr-2h6j
Aliases: CVE-2016-5007 |
Spring Security and Spring Framework may not recognize certain paths that should be protected Both Spring Security 3.2.x, 4.0.x, 4.1.0 … | There are no reported fixed by versions. |
|
GHSA-4487-x383-qpph
Aliases: CVE-2018-1272 |
Possible privilege escalation in org.springframework:spring-core Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older … | There are no reported fixed by versions. |
|
CVE-2023-20863
Aliases: GHSA-wxqc-pxw9-g2p8 |
Spring Framework vulnerable to denial of service In spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2016-5007
|
Spring Security / MVC Path Matching Inconsistency This package rely on URL pattern mappings for authorization and for mapping requests … |
Vulnerable Vulnerable |
|
CVE-2015-3192
Aliases: GHSA-6v7w-535j-rq5m |
Improper Restriction of Operations within the Bounds of a Memory Buffer Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 … | There are no reported fixed by versions. |
|
CVE-2018-1275
Aliases: GHSA-3rmv-2pg5-xvqj |
Improper Control of Generation of Code ('Code Injection') Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to … | There are no reported fixed by versions. |
|
GMS-2022-559
Aliases: CVE-2022-22965 GHSA-36p3-wjmg-h94x |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core. |
Vulnerable Vulnerable |
|
GHSA-659m-px2c-25wj
Aliases: CVE-2026-41848 |
Spring Framework Denial of Service via AntPathMatcher Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack … |
Not vulnerable Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2013-6429
|
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, … |