Search for packages
| purl | pkg:maven/org.springframework/spring-web@4.3.2.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-9gcm-f4x3-8jpw
Aliases: CVE-2018-11039 |
Spring Framework Cross Site Tracing (XST) Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older … | There are no reported fixed by versions. |
|
GHSA-4wrc-f8pq-fpqp
Aliases: CVE-2016-1000027 |
Pivotal Spring Framework contains unsafe Java deserialization methods Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution … |
Vulnerable |
|
GHSA-4gc7-5j7h-4qph
Aliases: CVE-2024-38820 |
Spring Framework DataBinder Case Sensitive Match Exception The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() … | There are no reported fixed by versions. |
|
GHSA-2wrp-6fg6-hmc5
Aliases: CVE-2024-22262 |
Spring Framework URL Parsing with Host Validation Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a … |
Vulnerable |
|
GHSA-ccgv-vj62-xf9h
Aliases: CVE-2024-22243 |
Spring Web vulnerable to Open Redirect or Server Side Request Forgery Applications that use UriComponentsBuilder to parse an externally provided … | There are no reported fixed by versions. |
|
GHSA-hgjh-9rj2-g67j
Aliases: CVE-2024-22259 |
Spring Framework URL Parsing with Host Validation Vulnerability Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided … |
Vulnerable |
|
GHSA-2rmj-mq67-h97g
Aliases: CVE-2024-38809 |
Spring Framework DoS via conditional HTTP request ### Description Applications that parse ETags from `If-Match` or `If-None-Match` request headers are … |
Vulnerable |
|
CVE-2020-5421
|
Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-15756
|
Uncontrolled Resource Consumption Spring Framework provides support for range requests when serving static resources through the `ResourceHttpRequestHandler`. A malicious user … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2018-11040
|
Inclusion of Functionality from Untrusted Control Sphere Spring Framework allows web applications to enable cross-domain requests via JSONP (JSON with … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-11039
|
Cross Site Scripting Spring Framework allows web applications to change the HTTP request method to any HTTP method (including TRACE) … |
Vulnerable Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2014-0225
|
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions … | |
|
CVE-2013-4152
|
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity … | |
|
CVE-2018-11039
|
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to … | |
|
CVE-2013-6429
|
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, … | |
|
CVE-2020-5397
|
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC … | |
|
CVE-2014-0054
|
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, … | |
|
CVE-2013-6430
|
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which … | |
|
CVE-2013-7315
|
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the … | |
|
CVE-2015-3192
|
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not … | |
|
CVE-2014-3578
|
Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary … |