Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.
No package-associated file paths were observed for the displayed build metadata.
OpenFactory puede arrancar este sistema operativo en una máquina virtual del navegador, o iniciar una construcción que incluye el nombre nativo del paquete de este registro.
Cada fila es metadato del índice de paquetes para una versión, arquitectura, suite y repositorio. Nombres, URL y tamaños vienen de la fuente; un enlace es un punto de descarga que puede cambiar, no una redistribución de OpenFactory.
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Sprin
Critical(9.8)
Desconocido
La asociación de paquetes está en curso. Observado:
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specifie
Critical(9.8)
Desconocido
La asociación de paquetes está en curso. Observado:
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or Bi
High(7.5)
Desconocido
La asociación de paquetes está en curso. Observado:
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.
Spring Framework 7.0.0 - 7.0.8
Medium(6.1)
Desconocido
La asociación de paquetes está en curso. Observado:
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.
High(7.5)
Desconocido
La asociación de paquetes está en curso. Observado:
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2
Critical(9.8)
Desconocido
La asociación de paquetes está en curso. Observado:
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.
Spring Framework 7.0.0 - 7.0.8
Spring Frame
Critical(9.8)
Desconocido
La asociación de paquetes está en curso. Observado:
A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.
Spring Framework 7.0.0 - 7.0.8
Sp
High(7.5)
Desconocido
La asociación de paquetes está en curso. Observado:
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configure
Medium(4.3)
Desconocido
La asociación de paquetes está en curso. Observado:
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldE
Medium(6.1)
Desconocido
La asociación de paquetes está en curso. Observado:
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.
Spring Fra
High(7.5)
Desconocido
La asociación de paquetes está en curso. Observado:
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.
Spring Fr
Critical(9.8)
Desconocido
La asociación de paquetes está en curso. Observado:
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spr
Low(3.7)
Desconocido
La asociación de paquetes está en curso. Observado:
IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules.
Affected versio
Medium(4.8)
Desconocido
La asociación de paquetes está en curso. Observado:
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenti
Medium(4.2)
Desconocido
La asociación de paquetes está en curso. Observado:
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 t
Medium(5.9)
Desconocido
La asociación de paquetes está en curso. Observado:
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.
Medium(5.9)
Desconocido
La asociación de paquetes está en curso. Observado:
Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6
High(7.5)
Desconocido
La asociación de paquetes está en curso. Observado:
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 thro
Medium(5.9)
Desconocido
La asociación de paquetes está en curso. Observado:
A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arb
Medium(4.2)
Desconocido
La asociación de paquetes está en curso. Observado:
