Search for packages
| purl | pkg:maven/org.springframework/spring-web@5.0.2.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-11039
|
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-15756
|
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-5397
|
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-9gcm-f4x3-8jpw
Aliases: CVE-2018-11039 |
Spring Framework Cross Site Tracing (XST) Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older … | There are no reported fixed by versions. |
|
GHSA-4wrc-f8pq-fpqp
Aliases: CVE-2016-1000027 |
Pivotal Spring Framework contains unsafe Java deserialization methods Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution … |
Vulnerable |
|
GHSA-4gc7-5j7h-4qph
Aliases: CVE-2024-38820 |
Spring Framework DataBinder Case Sensitive Match Exception The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() … | There are no reported fixed by versions. |
|
GHSA-2wrp-6fg6-hmc5
Aliases: CVE-2024-22262 |
Spring Framework URL Parsing with Host Validation Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a … |
Vulnerable |
|
GHSA-ccgv-vj62-xf9h
Aliases: CVE-2024-22243 |
Spring Web vulnerable to Open Redirect or Server Side Request Forgery Applications that use UriComponentsBuilder to parse an externally provided … | There are no reported fixed by versions. |
|
GHSA-hgjh-9rj2-g67j
Aliases: CVE-2024-22259 |
Spring Framework URL Parsing with Host Validation Vulnerability Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided … |
Vulnerable |
|
GHSA-2rmj-mq67-h97g
Aliases: CVE-2024-38809 |
Spring Framework DoS via conditional HTTP request ### Description Applications that parse ETags from `If-Match` or `If-None-Match` request headers are … |
Vulnerable |
|
CVE-2020-5421
|
Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-15756
|
Uncontrolled Resource Consumption Spring Framework provides support for range requests when serving static resources through the `ResourceHttpRequestHandler`. A malicious user … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-5398
|
Download of Code Without Integrity Check In Spring Framework, an application is vulnerable to a reflected file download (RFD) attack … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2018-11040
|
Inclusion of Functionality from Untrusted Control Sphere Spring Framework allows web applications to enable cross-domain requests via JSONP (JSON with … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-11039
|
Cross Site Scripting Spring Framework allows web applications to change the HTTP request method to any HTTP method (including TRACE) … |
Vulnerable Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2013-6429
|
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, … | |
|
CVE-2015-3192
|
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not … |