Skip to contentVmware Spring vulnerabilities
- spring by vmware framework, vmware spring framework, netapp oncommand insight +36 more +38 moreRFD Protection Bypass via jsessionidCVE-2020-5421Public exploitFix availableEPSS 11.6%8.7 High
- spring by vmware cloud netflix, vmware spring cloud netflix +1 moreHystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboardCVE-2020-5412Fix availableEPSS 10.2%6.5 Medium
- spring by vmware integration, vmware spring integration, oracle banking corporate lending process management +6 more +8 moreKryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"CVE-2020-5413Fix available9.8 Critical
- spring cloud config, vmware spring cloud config, vmware tanzu spring cloud configuration (config) server +2 moreDirectory Traversal with spring-cloud-config-serverCVE-2020-5410In KEVPublic exploitFix availableEPSS 95.6%7.5 High
- pivotal software spring security, spring security +1 moreDictionary attack with Spring Security queryable text encryptorCVE-2020-5408Fix available6.5 Medium
- spring cloud config, vmware spring cloud config +1 moreDirectory Traversal with spring-cloud-config-serverCVE-2020-5405Public exploitFix availableEPSS 68.5%6.5 Medium
- spring framework, vmware spring framework, oracle application testing suite +25 more +27 moreCSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFluxCVE-2020-5397Fix available5.3 Medium
- spring framework, vmware spring framework, netapp data availability services +31 more +33 moreRFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux ApplicationCVE-2020-5398Public exploitFix availableEPSS 88.3%8.0 High
- vmware spring frameworkPivotal Spring Framework contains unsafe Java deserialization methodsCVE-2016-1000027Public exploitFix availableEPSS 33.2%9.8 Critical
- spring security, vmware spring security, debian linux +2 morePlaintextPasswordEncoder authenticates encoded passwords that are nullCVE-2019-11272Fix available7.3 High
- spring cloud config, vmware spring cloud config, oracle communications cloud native core policy +2 moreDirectory Traversal with spring-cloud-config-serverCVE-2019-3799Public exploitFix availableEPSS 85.3%6.5 Medium
- spring security, vmware spring security, debian linux +2 moreInsecure Randomness When Using a SecureRandom Instance Constructed by Spring SecurityCVE-2019-3795Fix available3.8 Low
- spring integration, vmware spring integration, oracle retail customer management and segmentation foundation +2 moreSpring Integration XML External Entity Injection (XXE)CVE-2019-3772Fix available9.8 Critical
- spring security, vmware spring framework +1 moreAuthorization Bypass During JWT Issuer Validation with spring-securityCVE-2018-15801Fix available3.3 Low
- pivotal spring framework, debian linux, oracle agile product lifecycle management +37 more +39 moreDoS Attack via Range RequestsCVE-2018-15756Fix available7.5 High
- pivotal spring framework, debian linux, oracle agile product lifecycle management +25 more +27 moreModerate severity vulnerability that affects org.springframework:spring-coreCVE-2018-11040Fix available7.5 High
- pivotal spring framework, debian linux, oracle agile product lifecycle management +30 more +32 moreSpring Framework Cross Site Tracing (XST)CVE-2018-11039Fix available5.9 Medium
- pivotal spring integration zipspring-integration-zip Arbitrary File WriteCVE-2018-1263Public exploitFix available4.7 Medium
- pivotal spring integration zipPath traversal in org.springframework.integration:spring-integration-zipCVE-2018-1261Fix available4.7 Medium
- broadcom spring data commons, xmlbeam, pivotal software spring data rest +2 moreSpring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity referencesCVE-2018-1259Public exploitFix available7.5 High
- pivotal spring framework, pivotal software spring security, netapp oncommand insight +39 more +41 moreSpring Framework when used in combination with any versions of Spring Security contains an authorization bypassCVE-2018-1258Fix available8.8 High
- pivotal spring framework, oracle agile product lifecycle management, application testing suite +27 more +29 moreDenial of Service in org.springframework:spring-coreCVE-2018-1257Fix available6.5 Medium
- pivotal spring cloud sso connectorIssuer validation regression in Spring Cloud SSO ConnectorCVE-2018-1256Fix available8.1 High
- broadcom spring data commons, pivotal software spring data rest, spring by pivotal framework +1 more +3 moreSpring Data Commons contain a property path parser vulnerability caused by unlimited resource allocationCVE-2018-1274Fix available7.5 High
- spring by pivotal framework, vmware spring framework, oracle application testing suite +17 more +19 moreSpring Framework has Improperly Implemented Security Check for StandardCVE-2018-1275Fix availableEPSS 57.7%9.8 Critical
- broadcom spring data commons, pivotal software spring data rest, apache ignite +3 more +5 moreSpring Data Commons remote code injection vulnerabilityCVE-2018-1273In KEVPublic exploitFix availableEPSS 97.0%9.8 Critical
- spring by pivotal framework, vmware spring framework, oracle application testing suite +23 more +25 morePossible privilege escalation in org.springframework:spring-coreCVE-2018-1272Fix available7.5 High
- spring by pivotal framework, vmware spring framework, oracle application testing suite +26 more +28 morePath Traversal in org.springframework:spring-coreCVE-2018-1271Fix availableEPSS 30.3%5.9 Medium
- spring by pivotal framework, vmware spring framework, debian linux +26 more +28 moreSpring Framework allows applications to expose STOMP over WebSocket endpointsCVE-2018-1270Public exploitFix availableEPSS 77.6%9.8 Critical
- dell emc spring boot, spring boot +1 moreModerate severity vulnerability that affects org.springframework.boot:spring-bootCVE-2018-1196Fix available5.9 Medium
- vmware spring framework, spring security, dell emc spring by pivotal +3 more +5 moreImproper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-coreCVE-2018-1199Fix available5.3 Medium
- pivotal software spring data rest, vmware spring boot, pivotal spring data rest and spring boot +2 moreRemote code execution in PATCH requests in Spring Data RESTCVE-2017-8046Public exploitFix availableEPSS 74.5%9.8 Critical
- vmware spring securityDeserialization of Untrusted Data in Spring SecurityCVE-2017-4995Fix available8.1 High
- fedoraproject fedora, vmware spring social +1 morespringframework-social Cross-Site Request Forgery vulnerabilityCVE-2015-5258Fix available8.8 High
- pivotal spring framework, spring security, spring security +2 moreSpring Security and Spring Framework may not recognize certain paths that should be protectedCVE-2016-5007Fix available7.5 High
- pivotal spring security, spring security +1 moreAuthorization Bypass in Spring SecurityCVE-2014-3527Fix available9.8 Critical
- pivotal spring security, spring security +1 moreImproper Authentication in Spring SecurityCVE-2014-0097Fix available7.3 High
- fedoraproject fedora, vmware spring advanced message queuing protocol +1 moreImproper Input Validation in Spring AMQPCVE-2016-2173Public exploitFix available9.8 Critical
- ibm websphere application server, vmware spring security +1 moreSecurity Constraint Bypass in Spring SecurityCVE-2016-9879Fix available7.5 High
- pivotal software spring frameworkPivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitizedCVE-2016-9878Fix available7.5 High
- vmware spring framework, debian linux +1 moreFiles or Directories Accessible to External Parties in org.springframework:spring-coreCVE-2015-5211Fix available9.6 Critical
- pivotal software spring framework, fedoraproject fedora +1 morePivotal Spring Framework DoS Attack with XML InputCVE-2015-3192Fix available5.5 Medium
- pivotal spring frameworkImproper Restriction of XML External Entity Reference in Spring FrameworkCVE-2014-0225Fix available8.8 High
- pivotal software spring frameworkModerate severity vulnerability that affects org.springframework:spring-coreCVE-2015-0201Fix available5.0 Medium
- pivotal software spring frameworkImproper Limitation of a Pathname to a Restricted Directory in Spring FrameworkCVE-2014-3625Public exploitFix available5.0 Medium
- springsource spring frameworkCross-Site Request Forgery in Spring FrameworkCVE-2014-0054Fix availableEPSS 91.4%6.8 Medium
- pivotal software spring frameworkCross-Site Request Forgery in Spring FrameworkCVE-2013-6429Fix availableEPSS 90.6%6.8 Medium
- springsource spring frameworkMissing XML Validation in Spring FrameworkCVE-2013-7315Fix available6.8 Medium
- springsource spring frameworkCross-Site Request Forgery in Spring FrameworkCVE-2013-4152Fix availableEPSS 25.6%6.8 Medium
- vmware springsource spring securityExposure of Sensitive Information to an Unauthorized Actor in Spring SecurityCVE-2012-5055Fix available5.0 Medium
- Show moreLoading…