Read the docs

Springsource

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Springsource records in CISA KEV

No Springsource vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Spring Framework 5 records HIGH Application Management Suite 3 records LOW Hyperic Hq 3 records LOW Tc Server 3 records LOW Grails 1 record LOW

Records

5 records in Spring Framework · all components

TI-2014-00050 CVE-2014-0054 · GHSA-8cmm-qj8g-fcp6

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8…

Priority HIGH 73

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a d…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.91354 Published 2014-04-17 Partial fix · 3.2.8, 4.0.2 CWE-352
TI-2010-01566 CVE-2010-1622 · GHSA-vpr3-f594-mg5g

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and…

Priority MEDIUM 59

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: foll…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.52003 Published 2010-06-21 Fixed in 2.5.7, 3.0.3 CWE-94
TI-2013-03625 CVE-2013-4152 · GHSA-rp4p-g69r-438x

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB…

Priority MEDIUM 52

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial o…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.25634 Published 2014-01-23 Fixed in 3.2.4.RELEASE CWE-264
TI-2011-02390 CVE-2011-2730 · GHSA-wv88-pf73-x22p

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before…

Priority MEDIUM 46

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obt…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.11779 Published 2012-12-05 Partial fix · 3.0.6, 2.5.6.SEC03 +1 CWE-16
TI-2013-05980 CVE-2013-7315 · GHSA-vp63-rrcm-9mph

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not…

Priority LOW 38

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, ca…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05065 Published 2014-01-23 Fixed in 3.2.4.RELEASE CWE-264
Open these records in search →