Vulnerabilities

When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.

Values produced by ${random.value} are not suitable for use as secrets.

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.

A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`.

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret.