Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Springsource Component: Spring Framework Clear all filters
TI-2014-00050 CVE-2014-0054 · GHSA-8cmm-qj8g-fcp6

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8…

Priority HIGH 73

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a d…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.91354 Published 2014-04-17 Partial fix · 3.2.8, 4.0.2 CWE-352
TI-2013-05980 CVE-2013-7315 · GHSA-vp63-rrcm-9mph

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not…

Priority LOW 38

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, ca…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05065 Published 2014-01-23 Fixed in 3.2.4.RELEASE CWE-264
TI-2013-03625 CVE-2013-4152 · GHSA-rp4p-g69r-438x

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB…

Priority MEDIUM 52

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial o…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.25634 Published 2014-01-23 Fixed in 3.2.4.RELEASE CWE-264
TI-2011-02390 CVE-2011-2730 · GHSA-wv88-pf73-x22p

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before…

Priority MEDIUM 46

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obt…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.11779 Published 2012-12-05 Partial fix · 3.0.6, 2.5.6.SEC03 +1 CWE-16
TI-2010-01566 CVE-2010-1622 · GHSA-vpr3-f594-mg5g

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and…

Priority MEDIUM 59

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: foll…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.52003 Published 2010-06-21 Fixed in 2.5.7, 3.0.3 CWE-94