Springsource

Spring Framework

6 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2024-38828

  • EPSS 0.24%
  • Published 18.11.2024 04:15:04
  • Last modified 09.05.2025 20:15:38

Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

6.8

CVE-2014-0054

  • EPSS 34.58%
  • Published 17.04.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct ...

6.8

CVE-2013-7315

Exploit
  • EPSS 0.52%
  • Published 23.01.2014 21:55:05
  • Last modified 11.04.2025 00:51:21

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and c...

6.8

CVE-2013-4152

Exploit
  • EPSS 89.01%
  • Published 23.01.2014 21:55:04
  • Last modified 11.04.2025 00:51:21

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF at...

7.5

CVE-2011-2730

  • EPSS 53.57%
  • Published 05.12.2012 17:55:01
  • Last modified 11.04.2025 00:51:21

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via ...

6

CVE-2010-1622

Exploit
  • EPSS 1.67%
  • Published 21.06.2010 16:30:01
  • Last modified 11.04.2025 00:51:21

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .ja...