Search for packages
| purl | pkg:maven/org.springframework/spring-webmvc@3.2.7.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-hhm4-hwq6-3c6w
Aliases: CVE-2014-3625 |
Improper Limitation of a Pathname to a Restricted Directory in Spring Framework Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 … | There are no reported fixed by versions. |
|
GHSA-8cmm-qj8g-fcp6
Aliases: CVE-2014-0054 |
Cross-Site Request Forgery in Spring Framework The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 … | There are no reported fixed by versions. |
|
GHSA-36p3-wjmg-h94x
Aliases: CVE-2022-22965 |
Remote Code Execution in Spring Framework Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability … |
Vulnerable |
|
CVE-2014-3578
|
Directory traversal flaw Directory traversal vulnerability in this package allows remote attackers to read arbitrary files via a crafted URL. |
Vulnerable Vulnerable |
|
CVE-2014-0054
|
XML External Entities This package does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause … |
Vulnerable Vulnerable |
|
CVE-2014-3625
|
Directory traversal flaw Directory traversal vulnerability in this package allows remote attackers to read arbitrary files via unspecified vectors, related … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-5421
|
Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2014-1904
|
Cross-site scripting flaw Cross-site scripting (XSS) vulnerability in `web/servlet/tags/form/FormTag.java` in Spring MVC in this package allows remote attackers to inject … |
Vulnerable Vulnerable |
|
GHSA-2m8h-fgr8-2q9w
Aliases: CVE-2016-9878 |
Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized An issue was discovered in Pivotal Spring Framework … | There are no reported fixed by versions. |
|
GHSA-f93f-g33r-8pcp
Aliases: CVE-2014-0225 |
Improper Restriction of XML External Entity Reference in Spring Framework When processing user provided XML documents, the Spring Framework 4.0.0 … | There are no reported fixed by versions. |
|
CVE-2016-9878
|
Path Traversal Paths provided to the `ResourceServlet` were not properly sanitized and as a result exposed to directory traversal attacks. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1272
|
Improper Privilege Management When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and … |
Vulnerable Vulnerable |
|
CVE-2018-1271
|
Path Traversal Spring Framework allows applications to configure Spring MVC to serve static resources (e.g., CSS, JS, images). When static … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-ff7p-jqjm-v66h
Aliases: CVE-2014-1904 |
Improper Neutralization of Input During Web Page Generation in Spring Framework Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-g5vr-rgqm-vf78
Aliases: CVE-2024-38819 |
Spring Framework Path Traversal vulnerability Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to … | There are no reported fixed by versions. |
|
GHSA-wg35-8jpf-2xv3
Aliases: CVE-2026-22741 |
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-6p4f-wcwh-5vvm
Aliases: CVE-2026-22745 |
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application … |
Vulnerable Vulnerable |
|
GHSA-957g-f97v-vppc
Aliases: CVE-2026-41846 |
Spring Framework Cross-site Scripting via JSP Form Tags Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or … |
Vulnerable Vulnerable |
|
GHSA-h3qp-gqrc-q736
Aliases: CVE-2026-41844 |
Spring Framework Open Redirect in Spring MVC and WebFlux A Spring MVC or Spring WebFlux application which configures a mapping … |
Vulnerable Vulnerable |
|
GHSA-mq64-j8f9-9gcj
Aliases: CVE-2026-41841 |
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable … |
Vulnerable Vulnerable |
|
GHSA-72pg-x5f8-j25j
Aliases: CVE-2026-41843 |
Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable … |
Vulnerable Vulnerable |
|
GHSA-x23c-287f-qqv5
Aliases: CVE-2026-41842 |
Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable … |
Vulnerable Vulnerable |
|
GHSA-cjpg-rgq5-fr37
Aliases: CVE-2026-41853 |
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable to Multipart request … |
Vulnerable Vulnerable |
|
GHSA-3chg-m5w7-qfv5
Aliases: CVE-2026-41845 |
Spring Framework Cross-site Scripting via JavaScriptUtils Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection … |
Vulnerable Vulnerable |
|
GHSA-pc63-qcmh-9cmg
Aliases: CVE-2026-47884 |
Spring Framework Improper Path Limitation in XsltView Use of XsltView in a Spring MVC application can result in SSRF and … | There are no reported fixed by versions. |
|
CVE-2026-47884
Aliases: GHSA-pc63-qcmh-9cmg |
Spring Framework Improper Path Limitation in XsltView Use of XsltView in a Spring MVC application can result in SSRF and … |
Not vulnerable |