org.springframework:spring-core

vulnerable: 1.1 ... 2.5.6.SEC03 (44 versions)

Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 a…

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive infor…

vulnerable: 3.0.0.RELEASE ... 3.0.5.RELEASE (6 versions)

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictio…

vulnerable: 4.0.0.RELEASE, 4.0.1.RELEASE, 4.0.2.RELEASE, 4.0.3.RELEASE, 4.0.4.RELEASE

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

vulnerable: 4.1.0.RELEASE, 4.1.1.RELEASE, 4.1.2.RELEASE, 4.1.3.RELEASE, 4.1.4.RELEASE

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

vulnerable: 1.0 ... 3.2.9.RELEASE (77 versions)

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a …

vulnerable: 1.0 ... 4.3.0.RELEASE (112 versions)

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern …

vulnerable: 4.3.0.RELEASE ... 4.3.9.RELEASE (18 versions)

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for RES…

vulnerable: 5.0.0.RELEASE, 5.0.1.RELEASE, 5.0.2.RELEASE

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. B…

vulnerable: 1.0 ... 4.3.9.RELEASE (128 versions)

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging…

vulnerable: 5.0.5.RELEASE

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be…

vulnerable: 1.0 ... 4.3.9.RELEASE (126 versions)

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served fr…

vulnerable: 5.0.0.RELEASE, 5.0.1.RELEASE, 5.0.2.RELEASE, 5.0.3.RELEASE, 5.0.4.RELEASE

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives inp…

vulnerable: 4.2.0.RELEASE ... 4.3.9.RELEASE (30 versions)

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequ…

vulnerable: 5.2.0.RELEASE ... 5.2.9.RELEASE (19 versions)

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that …

vulnerable: 5.2.0.RELEASE ... 5.2.9.RELEASE (18 versions)

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

vulnerable: 6.0.15

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following a…

vulnerable: 6.2.0 ... 6.2.9 (11 versions)

The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for aut…