VulnerableCode Package Details - pkg:maven/org.springframework/spring-core@5.0.3.RELEASE

Vulnerabilities affecting this package (16)

Advisory	Summary	Fixed in package version
CVE-2018-1272	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support …	4.3.15.RELEASE Vulnerable 4.3.16.RELEASE Vulnerable 4.3.17.RELEASE Vulnerable 4.3.18.RELEASE Vulnerable 4.3.20.RELEASE Vulnerable 5.0.5.RELEASE Vulnerable 5.0.6.RELEASE Vulnerable 5.0.7.RELEASE Vulnerable 5.0.13.RELEASE Vulnerable 5.0.16.RELEASE Vulnerable 5.1.0.RELEASE Vulnerable 5.1.1.RELEASE Vulnerable 5.1.13.RELEASE Vulnerable 5.1.14.RELEASE Vulnerable 5.1.17.RELEASE Vulnerable 5.2.0.RELEASE Vulnerable 5.2.1.RELEASE Vulnerable 5.2.3.RELEASE Vulnerable 5.2.4.RELEASE Vulnerable 4.3.19.RELEASE Vulnerable 4.3.21.RELEASE Vulnerable 4.3.22.RELEASE Vulnerable 4.3.23.RELEASE Vulnerable 4.3.24.RELEASE Vulnerable 4.3.25.RELEASE Vulnerable 4.3.26.RELEASE Vulnerable 5.0.8.RELEASE Vulnerable 5.0.9.RELEASE Vulnerable 5.0.10.RELEASE Vulnerable 5.0.11.RELEASE Vulnerable 5.0.12.RELEASE Vulnerable 5.0.14.RELEASE Vulnerable 5.0.15.RELEASE Vulnerable 5.1.2.RELEASE Vulnerable 5.1.3.RELEASE Vulnerable 5.1.4.RELEASE Vulnerable 5.1.5.RELEASE Vulnerable 5.1.6.RELEASE Vulnerable 5.1.7.RELEASE Vulnerable 5.1.8.RELEASE Vulnerable 5.1.9.RELEASE Vulnerable 5.1.10.RELEASE Vulnerable 5.1.11.RELEASE Vulnerable 5.1.12.RELEASE Vulnerable 5.1.15.RELEASE Vulnerable 5.1.16.RELEASE Vulnerable 5.2.2.RELEASE Vulnerable 5.2.5.RELEASE Vulnerable 5.2.6.RELEASE Vulnerable 5.2.7.RELEASE Vulnerable 5.2.8.RELEASE Vulnerable
CVE-2022-22971 Aliases: GHSA-rqph-vqwm-22vc	Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, application …	5.3.20 Vulnerable 5.2.22.RELEASE Vulnerable
CVE-2023-20861 Aliases: GHSA-564r-hj7v-mcr5	Spring Framework vulnerable to denial of service via specially crafted SpEL expression In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 …	5.3.26 Vulnerable 6.0.7 Vulnerable 5.2.23.RELEASE Vulnerable
CVE-2020-5421	Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser …	5.1.18.RELEASE Vulnerable 5.0.19.RELEASE Vulnerable 4.3.29.RELEASE Vulnerable 5.2.9.RELEASE Vulnerable
CVE-2022-22970 Aliases: GHSA-hh26-6xwr-ggv7	Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, applications …	5.3.20 Vulnerable 5.2.22.RELEASE Vulnerable
CVE-2022-22968 Aliases: GHSA-g5mm-vmx4-3rg7	Improper Handling of Case Sensitivity In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the …	5.3.19 Vulnerable
CVE-2019-3795	Insufficient Entropy in PRNG Spring Security contain an insecure randomness vulnerability when using `SecureRandomFactoryBean#setSeed` to configure a `SecureRandom` instance. In …	4.3.0.RELEASE Vulnerable 5.0.13.RELEASE Vulnerable 5.1.6.RELEASE Vulnerable
GHSA-f26x-pr96-vw86 Aliases: CVE-2018-11040	Moderate severity vulnerability that affects org.springframework:spring-core Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older …	5.0.7.RELEASE Vulnerable 5.0.7.RELEASE Vulnerable
GHSA-g8hw-794c-4j9g Aliases: CVE-2018-1271	Path Traversal in org.springframework:spring-core Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported …	There are no reported fixed by versions.
GHSA-rcpf-vj53-7h2m Aliases: CVE-2018-1257	Denial of Service in org.springframework:spring-core Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported …	There are no reported fixed by versions.
GHSA-4487-x383-qpph Aliases: CVE-2018-1272	Possible privilege escalation in org.springframework:spring-core Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older …	There are no reported fixed by versions.
GHSA-ffvq-7w96-97p7 Aliases: CVE-2018-15756	Denial of Service in Spring Framework Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, …	5.0.10.RELEASE Vulnerable 5.0.10.RELEASE Vulnerable
CVE-2023-20863 Aliases: GHSA-wxqc-pxw9-g2p8	Spring Framework vulnerable to denial of service In spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible …	5.3.27 Vulnerable 6.0.8 Vulnerable 5.2.24.RELEASE Vulnerable 5.3.27 Vulnerable 6.0.8 Vulnerable 5.2.24.RELEASE Vulnerable
CVE-2018-1275 Aliases: GHSA-3rmv-2pg5-xvqj	Improper Control of Generation of Code ('Code Injection') Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to …	There are no reported fixed by versions.
GMS-2022-559 Aliases: CVE-2022-22965 GHSA-36p3-wjmg-h94x	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.	5.3.18 Vulnerable 5.3.18 Vulnerable
GHSA-659m-px2c-25wj Aliases: CVE-2026-41848	Spring Framework Denial of Service via AntPathMatcher Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack …	7.0.8 Not vulnerable 6.2.19 Not vulnerable

Next non-vulnerable version	6.2.19
Latest non-vulnerable version	7.0.8
Risk score	3.4

Advisory	Summary	Aliases
CVE-2015-0201	The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to …
CVE-2013-6429	The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, …