Clinical Management System
Other 32 hrs 54 mins ██████████████████████▒░░ 88.67 %
Java 1 hr 48 mins █▒░░░░░░░░░░░░░░░░░░░░░░░ 04.89 %
HTML 57 mins ▓░░░░░░░░░░░░░░░░░░░░░░░░ 02.59 %
JavaScript 40 mins ▒░░░░░░░░░░░░░░░░░░░░░░░░ 01.83 %
HTTP Request 9 mins ░░░░░░░░░░░░░░░░░░░░░░░░░ 00.42 %
![mend-bolt-for-github[bot] avatar](https://avatars.githubusercontent.com/in/16809?v=4 "mend-bolt-for-github[bot]")
Vulnerable Library - spring-web-5.2.3.RELEASE.jarSpring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.2.3.RELEASE/dd386a02e40b915ab400a3bf9f586d2dc4c0852c/spring-web-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
Publish Date: 2021-05-27
URL: CVE-2021-22118
CVSS 3 Score Details (7.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2021-22118
Release Date: 2021-05-27
Fix Resolution (org.springframework:spring-web): 5.2.15.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-websocket): 2.3.11.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-websocket-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-websocket/9.0.30/33157f6bc5bfd03380ebb5ac476db0600a04168d/tomcat-embed-websocket-9.0.30.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Publish Date: 2020-07-14
URL: CVE-2020-13935
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-07-14
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-websocket): 9.0.37
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.9.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - thymeleaf-spring5-3.0.11.RELEASE.jarModern server-side Java template engine for both web and standalone environments
Library home page: http://www.thymeleaf.org
Path to dependency file: borelesgamuwaMedical/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring5/3.0.11.RELEASE/de7bf0adf13b5e9c4811f95edf18279da193c0c6/thymeleaf-spring5-3.0.11.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Publish Date: 2021-11-09
URL: CVE-2021-43466
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43466
Release Date: 2021-11-09
Fix Resolution: org.thymeleaf:thymeleaf-spring5 - 3.0.13.RELEASE
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - spring-security-web-5.2.1.RELEASE.jarspring-security-web
Library home page: http://spring.io/spring-security
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/5.2.1.RELEASE/9e43c2d8d2dffc60bfba8ac95a106d30e9593106/spring-security-web-5.2.1.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: b90bfdbe7711eb6748de1591dbe46b4a3fe59f13
Found in base branch: master
Vulnerability Details
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Publish Date: 2021-02-23
URL: CVE-2021-22112
CVSS 3 Score Details (8.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2021-22112
Release Date: 2021-02-23
Fix Resolution (org.springframework.security:spring-security-web): 5.2.9.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 2.3.0.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - jackson-databind-2.10.2.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.10.2/528de95f198afafbcfb0c09d2e43b6e0ea663ec/jackson-databind-2.10.2.jar
Dependency Hierarchy:
Found in HEAD commit: fbba202429891343d01b290f5f36b7fe676a19b5
Found in base branch: master
Vulnerability Details
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Publish Date: 2020-12-03
URL: CVE-2020-25649
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-12-03
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.10.5.1
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.3.0.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in HEAD commit: b90bfdbe7711eb6748de1591dbe46b4a3fe59f13
Found in base branch: master
Vulnerability Details
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
Publish Date: 2021-03-01
URL: CVE-2021-25329
CVSS 3 Score Details (7.0)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2021-03-01
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.43
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
Publish Date: 2021-01-14
URL: CVE-2021-24122
CVSS 3 Score Details (5.9)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24122
Release Date: 2021-01-14
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.40
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in HEAD commit: b90bfdbe7711eb6748de1591dbe46b4a3fe59f13
Found in base branch: master
Vulnerability Details
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Publish Date: 2020-02-24
URL: CVE-2020-1935
CVSS 3 Score Details (4.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-6v7p-v754-j89v
Release Date: 2020-02-24
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.31
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - itextpdf-5.5.9.jarA Free Java-PDF library
Library home page: http://itextpdf.com
Path to dependency file: /build.gradle
Path to vulnerable library: /canner/.gradle/caches/modules-2/files-2.1/com.itextpdf/itextpdf/5.5.9/af7e24e11af3aeb7f25dfe342b050dd1618f2a54/itextpdf-5.5.9.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
Publish Date: 2017-11-08
URL: CVE-2017-9096
CVSS 3 Score Details (8.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9096
Release Date: 2017-11-08
Fix Resolution: 5.5.12
Step up your Open Source Security Game with Mend here
Vulnerable Library - hibernate-validator-6.0.18.Final.jarHibernate's Bean Validation (JSR-380) reference implementation.
Library home page: http://hibernate.org/validator
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.hibernate.validator/hibernate-validator/6.0.18.Final/7fd00bcd87e14b6ba66279282ef15efa30dd2492/hibernate-validator-6.0.18.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
Publish Date: 2020-05-06
URL: CVE-2020-10693
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://in.relation.to/2020/05/07/hibernate-validator-615-6020-released/
Release Date: 2020-05-06
Fix Resolution (org.hibernate.validator:hibernate-validator): 6.0.20.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-security-web-5.2.1.RELEASE.jarspring-security-web
Library home page: http://spring.io/spring-security
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/5.2.1.RELEASE/9e43c2d8d2dffc60bfba8ac95a106d30e9593106/spring-security-web-5.2.1.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Cross-Site Request Forgery (CSRF) vulnerability was found in spring-security before 4.2.15, 5.0.15, 5.1.9, 5.2.3, and 5.3.1. SwitchUserFilter responds to all HTTP methods, making it vulnerable to CSRF attacks.
Publish Date: 2017-01-03
URL: WS-2017-3767
CVSS 3 Score Details (6.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2017-01-03
Fix Resolution (org.springframework.security:spring-security-web): 5.2.3.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 2.2.7.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Publish Date: 2021-03-01
URL: CVE-2021-25122
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2021-03-01
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.43
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - jquery-3.4.1.jarWebJar for jQuery
Library home page: http://webjars.org
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.webjars/jquery/3.4.1/f9cd2ff7f2da4c3f6839e9d5e5e92b0bbe1cbfb/jquery-3.4.1.jar,/canner/.gradle/caches/modules-2/files-2.1/org.webjars/jquery/3.4.1/f9cd2ff7f2da4c3f6839e9d5e5e92b0bbe1cbfb/jquery-3.4.1.jar
Dependency Hierarchy:
Found in HEAD commit: b90bfdbe7711eb6748de1591dbe46b4a3fe59f13
Found in base branch: master
Vulnerability Details
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11023
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-04-29
Fix Resolution: 3.5.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-expression-5.2.3.RELEASE.jarSpring Expression Language (SpEL)
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-expression/5.2.3.RELEASE/d0c6bb10758805b2153c589686b8045554bfac2d/spring-expression-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
Publish Date: 2022-04-01
URL: CVE-2022-22950
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2022-22950
Release Date: 2022-04-01
Fix Resolution (org.springframework:spring-expression): 5.2.20.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-aop): 2.4.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - snakeyaml-1.25.jarYAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210326084250_WYAZFD/downloadResource_YEWAPF/20210326084323/snakeyaml-1.25.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Publish Date: 2022-09-05
URL: CVE-2022-38751
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47039
Release Date: 2022-09-05
Fix Resolution (org.yaml:snakeyaml): 1.31
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-aop): 3.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-security-core-5.2.1.RELEASE.jarspring-security-core
Library home page: http://spring.io/spring-security
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-core/5.2.1.RELEASE/f1265ecdd4636a2038768c2ab9da4b79961a3465/spring-security-core-5.2.1.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Publish Date: 2020-05-14
URL: CVE-2020-5408
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5408
Release Date: 2020-05-14
Fix Resolution (org.springframework.security:spring-security-core): 5.2.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 2.2.7.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-2.2.4.RELEASE.jarSpring Boot
Library home page: https://projects.spring.io/spring-boot/#/spring-boot-parent/spring-boot
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/2.2.4.RELEASE/225a4fd31156c254e3bb92adb42ee8c6de812714/spring-boot-2.2.4.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
** UNSUPPORTED WHEN ASSIGNED ** spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer.
Publish Date: 2022-03-30
URL: CVE-2022-27772
CVSS 3 Score Details (7.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-cm59-pr5q-cw85
Release Date: 2022-03-30
Fix Resolution (org.springframework.boot:spring-boot): 2.2.11.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.2.11.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
Publish Date: 2020-06-26
URL: CVE-2020-11996
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-06-26
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.36
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - snakeyaml-1.25.jarYAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210326084250_WYAZFD/downloadResource_YEWAPF/20210326084323/snakeyaml-1.25.jar
Dependency Hierarchy:
Found in HEAD commit: fbba202429891343d01b290f5f36b7fe676a19b5
Found in base branch: master
Vulnerability Details
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Publish Date: 2019-12-12
URL: CVE-2017-18640
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18640
Release Date: 2019-12-12
Fix Resolution (org.yaml:snakeyaml): 1.26
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-aop): 2.3.0.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - guava-28.0-android.jarGuava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.
Library home page: https://github.com/google/guava
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/28.0-android/3679f8e9a5e0544c361a3225a3e7bbd5febe5f29/guava-28.0-android.jar
Dependency Hierarchy:
Found in HEAD commit: fbba202429891343d01b290f5f36b7fe676a19b5
Found in base branch: master
Vulnerability Details
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
Publish Date: 2020-12-10
URL: CVE-2020-8908
CVSS 3 Score Details (3.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908
Release Date: 2020-12-10
Fix Resolution (com.google.guava:guava): 30.0-android
Direct dependency fix Resolution (com.twilio.sdk:twilio): 8.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - mysql-connector-java-8.0.19.jarJDBC Type 4 driver for MySQL
Library home page: http://dev.mysql.com/doc/connector-j/en/
Path to dependency file: /build.gradle
Path to vulnerable library: /20210326084250_WYAZFD/downloadResource_YEWAPF/20210326084323/mysql-connector-java-8.0.19.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.19 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.0 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L).
Publish Date: 2020-04-15
URL: CVE-2020-2934
CVSS 3 Score Details (5.0)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.oracle.com/security-alerts/cpuapr2020.html
Release Date: 2020-04-15
Fix Resolution: 8.0.20
Step up your Open Source Security Game with Mend here
Vulnerable Library - snakeyaml-1.25.jarYAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210326084250_WYAZFD/downloadResource_YEWAPF/20210326084323/snakeyaml-1.25.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Publish Date: 2022-09-05
URL: CVE-2022-38750
CVSS 3 Score Details (5.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027
Release Date: 2022-09-05
Fix Resolution (org.yaml:snakeyaml): 1.31
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-aop): 3.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - jackson-databind-2.10.2.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.10.2/528de95f198afafbcfb0c09d2e43b6e0ea663ec/jackson-databind-2.10.2.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
FasterXML jackson-databind before 2.12.6 and 2.13.1 there is DoS when using JDK serialization to serialize JsonNode.
Publish Date: 2021-11-20
URL: WS-2021-0616
CVSS 3 Score Details (5.9)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2021-11-20
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.12.6, 2.13.1; com.fasterxml.jackson.core:jackson-core:2.12.6, 2.13.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Publish Date: 2020-10-12
URL: CVE-2020-13943
CVSS 3 Score Details (4.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-10-12
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.38
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-security-web-5.2.1.RELEASE.jarspring-security-web
Library home page: http://spring.io/spring-security
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/5.2.1.RELEASE/9e43c2d8d2dffc60bfba8ac95a106d30e9593106/spring-security-web-5.2.1.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Spring Security before 5.2.9, 5.3.7, and 5.4.3 vulnerable to side-channel attacks. Vulnerable versions of Spring Security don't use constant time comparisons for CSRF tokens.
Publish Date: 2020-12-17
URL: WS-2020-0293
CVSS 3 Score Details (5.9)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-12-17
Fix Resolution (org.springframework.security:spring-security-web): 5.2.9.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 2.3.0.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
Publish Date: 2021-09-16
URL: CVE-2021-41079
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://tomcat.apache.org/security-10.html
Release Date: 2021-09-16
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.44
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Publish Date: 2020-07-14
URL: CVE-2020-13934
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-07-14
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.37
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
Publish Date: 2020-05-20
URL: CVE-2020-9484
CVSS 3 Score Details (7.0)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9484
Release Date: 2020-05-20
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.35
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.8.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Libraries - logback-core-1.2.3.jar, logback-classic-1.2.3.jar
logback-core module
Library home page: http://logback.qos.ch
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.2.3/864344400c3d4d92dfeb0a305dc87d953677c03c/logback-core-1.2.3.jar
Dependency Hierarchy:
logback-classic module
Library home page: http://logback.qos.ch
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.2.3/7c4f3c474fb2c041d8028740440937705ebb473a/logback-classic-1.2.3.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
Mend Note: Converted from WS-2021-0491, on 2022-11-07.
Publish Date: 2021-12-16
URL: CVE-2021-42550
CVSS 3 Score Details (6.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2021-42550
Release Date: 2021-12-16
Fix Resolution (ch.qos.logback:logback-core): 1.2.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-aop): 2.5.8
Fix Resolution (ch.qos.logback:logback-classic): 1.2.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-aop): 2.5.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - httpclient-4.5.10.jarApache HttpComponents Client
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.5.10/7ca2e4276f4ef95e4db725a8cd4a1d1e7585b9e5/httpclient-4.5.10.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Publish Date: 2020-12-02
URL: CVE-2020-13956
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956
Release Date: 2020-12-02
Fix Resolution (org.apache.httpcomponents:httpclient): 4.5.13
Direct dependency fix Resolution (com.twilio.sdk:twilio): 7.43.0
Step up your Open Source Security Game with Mend here
Vulnerable Libraries - spring-webmvc-5.2.3.RELEASE.jar, spring-core-5.2.3.RELEASE.jar, spring-web-5.2.3.RELEASE.jar
Spring Web MVC
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/5.2.3.RELEASE/745a62502023d2496b565b7fe102bb1ee229d6b7/spring-webmvc-5.2.3.RELEASE.jar
Dependency Hierarchy:
Spring Core
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/5.2.3.RELEASE/3734223040040e8c3fecd5faa3ae8a1ed6da146b/spring-core-5.2.3.RELEASE.jar
Dependency Hierarchy:
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.2.3.RELEASE/dd386a02e40b915ab400a3bf9f586d2dc4c0852c/spring-web-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.
Publish Date: 2021-10-28
URL: CVE-2021-22096
CVSS 3 Score Details (4.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2021-22096
Release Date: 2021-10-28
Fix Resolution (org.springframework:spring-webmvc): 5.2.18.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.4.0
Fix Resolution (org.springframework:spring-core): 5.2.18.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.4.0
Fix Resolution (org.springframework:spring-web): 5.2.18.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-websocket): 2.4.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - tomcat-embed-core-9.0.30.jarCore Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.30/ad32909314fe2ba02cec036434c0addd19bcc580/tomcat-embed-core-9.0.30.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
Publish Date: 2021-07-12
URL: CVE-2021-33037
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2021-07-12
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.48
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - snakeyaml-1.25.jarYAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /build.gradle
Path to vulnerable library: /tmp/ws-ua_20210326084250_WYAZFD/downloadResource_YEWAPF/20210326084323/snakeyaml-1.25.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
Publish Date: 2022-09-05
URL: CVE-2022-38752
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-9w3m-gqgf-c4p9
Release Date: 2022-09-05
Fix Resolution (org.yaml:snakeyaml): 1.32
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-aop): 3.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - jackson-databind-2.10.2.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.10.2/528de95f198afafbcfb0c09d2e43b6e0ea663ec/jackson-databind-2.10.2.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Mend Note: After conducting further research, Mend has determined that all versions of com.fasterxml.jackson.core:jackson-databind up to version 2.13.2 are vulnerable to CVE-2020-36518.
Publish Date: 2022-03-11
URL: CVE-2020-36518
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-03-11
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.6.1
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.2.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - mysql-connector-java-8.0.19.jarJDBC Type 4 driver for MySQL
Library home page: http://dev.mysql.com/doc/connector-j/en/
Path to dependency file: /build.gradle
Path to vulnerable library: /20210326084250_WYAZFD/downloadResource_YEWAPF/20210326084323/mysql-connector-java-8.0.19.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Publish Date: 2022-01-19
URL: CVE-2022-21363
CVSS 3 Score Details (6.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-g76j-4cxx-23h9
Release Date: 2022-01-19
Fix Resolution: mysql:mysql-connector-java:8.0.28
Step up your Open Source Security Game with Mend here
Vulnerable Libraries - spring-core-5.2.3.RELEASE.jar, spring-web-5.2.3.RELEASE.jar
Spring Core
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/5.2.3.RELEASE/3734223040040e8c3fecd5faa3ae8a1ed6da146b/spring-core-5.2.3.RELEASE.jar
Dependency Hierarchy:
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.2.3.RELEASE/dd386a02e40b915ab400a3bf9f586d2dc4c0852c/spring-web-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
Publish Date: 2022-01-10
URL: CVE-2021-22060
CVSS 3 Score Details (4.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-6gf2-pvqw-37ph
Release Date: 2022-01-10
Fix Resolution (org.springframework:spring-core): 5.2.19.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.4.0
Fix Resolution (org.springframework:spring-web): 5.2.19.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-websocket): 2.4.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-5.2.3.RELEASE.jarSpring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.2.3.RELEASE/dd386a02e40b915ab400a3bf9f586d2dc4c0852c/spring-web-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Mend Note: After conducting further research, Mend has determined that all versions of spring-web up to version 6.0.0 are vulnerable to CVE-2016-1000027.
Publish Date: 2020-01-02
URL: CVE-2016-1000027
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-4wrc-f8pq-fpqp
Release Date: 2020-01-02
Fix Resolution (org.springframework:spring-web): 5.2.23.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-websocket): 2.4.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-beans-5.2.3.RELEASE.jarSpring Beans
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-beans/5.2.3.RELEASE/250c8c641433dc06b1b44e4563fa08a2fbf8954/spring-beans-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Mend Note: Converted from WS-2022-0107, on 2022-11-07.
Publish Date: 2022-04-01
URL: CVE-2022-22965
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
Release Date: 2022-04-01
Fix Resolution (org.springframework:spring-beans): 5.2.20.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-aop): 2.4.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-security-web-5.2.1.RELEASE.jarspring-security-web
Library home page: http://spring.io/spring-security
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/5.2.1.RELEASE/9e43c2d8d2dffc60bfba8ac95a106d30e9593106/spring-security-web-5.2.1.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
CSRF tokens in Spring Security are vulnerable to a breach attack. Spring Security always returns the same CSRF token to the browser.
Publish Date: 2016-08-02
URL: WS-2016-7107
CVSS 3 Score Details (5.9)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2016-7107
Release Date: 2016-08-02
Fix Resolution (org.springframework.security:spring-security-web): 5.2.14.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 2.3.0.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - hibernate-core-5.4.10.Final.jarHibernate's core ORM functionality
Library home page: http://hibernate.org/orm
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.hibernate/hibernate-core/5.4.10.Final/365690f87b040dc5d22cc24a4daff76d1cffef23/hibernate-core-5.4.10.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Publish Date: 2020-07-06
URL: CVE-2019-14900
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14900
Release Date: 2020-07-06
Fix Resolution (org.hibernate:hibernate-core): 5.4.18.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-jpa): 2.2.9.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-context-5.2.3.RELEASE.jarSpring Context
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-context/5.2.3.RELEASE/7750c95c96c7a1885c8b1b503ba915bc33ca579a/spring-context-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
Publish Date: 2022-04-14
URL: CVE-2022-22968
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2022-22968
Release Date: 2022-04-14
Fix Resolution (org.springframework:spring-context): 5.2.21.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.4.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-5.2.3.RELEASE.jarSpring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.2.3.RELEASE/dd386a02e40b915ab400a3bf9f586d2dc4c0852c/spring-web-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Publish Date: 2020-09-19
URL: CVE-2020-5421
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2020-5421
Release Date: 2020-09-19
Fix Resolution (org.springframework:spring-web): 5.2.9.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-websocket): 2.2.10.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - jquery-3.4.1.jarWebJar for jQuery
Library home page: http://webjars.org
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.webjars/jquery/3.4.1/f9cd2ff7f2da4c3f6839e9d5e5e92b0bbe1cbfb/jquery-3.4.1.jar,/canner/.gradle/caches/modules-2/files-2.1/org.webjars/jquery/3.4.1/f9cd2ff7f2da4c3f6839e9d5e5e92b0bbe1cbfb/jquery-3.4.1.jar
Dependency Hierarchy:
Found in HEAD commit: b90bfdbe7711eb6748de1591dbe46b4a3fe59f13
Found in base branch: master
Vulnerability Details
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11022
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
Release Date: 2020-04-29
Fix Resolution: 3.5.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - poi-3.8.jarApache POI - Java API To Access Microsoft Format Files
Library home page: http://poi.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /20210326084250_WYAZFD/downloadResource_YEWAPF/20210326084320/poi-3.8.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
Apache POI before 3.16-beta1 is vulnerable to bufferoverflow attack due to lack of length sanity check for length of embedded OLE10Native.
Publish Date: 2016-10-14
URL: WS-2016-7061
CVSS 3 Score Details (4.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2016-10-14
Fix Resolution: 3.16-beta1
Step up your Open Source Security Game with Mend here
Vulnerable Library - hibernate-core-5.4.10.Final.jarHibernate's core ORM functionality
Library home page: http://hibernate.org/orm
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.hibernate/hibernate-core/5.4.10.Final/365690f87b040dc5d22cc24a4daff76d1cffef23/hibernate-core-5.4.10.Final.jar
Dependency Hierarchy:
Found in HEAD commit: fbba202429891343d01b290f5f36b7fe676a19b5
Found in base branch: master
Vulnerability Details
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Publish Date: 2020-12-02
URL: CVE-2020-25638
CVSS 3 Score Details (7.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://in.relation.to/2020/11/19/hibernate-orm-5424-final-release/
Release Date: 2020-12-02
Fix Resolution (org.hibernate:hibernate-core): 5.4.24.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-jpa): 2.2.12.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-messaging-5.2.3.RELEASE.jarSpring Messaging
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-messaging/5.2.3.RELEASE/63e04381f0cde9d7d69fe405cd5ea31896b99b14/spring-messaging-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
Publish Date: 2022-05-12
URL: CVE-2022-22971
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2022-22971
Release Date: 2022-05-12
Fix Resolution (org.springframework:spring-messaging): 5.2.22.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-websocket): 2.4.0
Step up your Open Source Security Game with Mend here
Vulnerable Libraries - spring-beans-5.2.3.RELEASE.jar, spring-core-5.2.3.RELEASE.jar
Spring Beans
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-beans/5.2.3.RELEASE/250c8c641433dc06b1b44e4563fa08a2fbf8954/spring-beans-5.2.3.RELEASE.jar
Dependency Hierarchy:
Spring Core
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/5.2.3.RELEASE/3734223040040e8c3fecd5faa3ae8a1ed6da146b/spring-core-5.2.3.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
Publish Date: 2022-05-12
URL: CVE-2022-22970
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2022-22970
Release Date: 2022-05-12
Fix Resolution (org.springframework:spring-beans): 5.2.22.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-aop): 2.4.0
Fix Resolution (org.springframework:spring-core): 5.2.22.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-actuator): 2.4.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - poi-3.8.jarApache POI - Java API To Access Microsoft Format Files
Library home page: http://poi.apache.org/
Path to dependency file: /build.gradle
Path to vulnerable library: /20210326084250_WYAZFD/downloadResource_YEWAPF/20210326084320/poi-3.8.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
Publish Date: 2018-01-29
URL: CVE-2017-12626
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2018-01-26
Fix Resolution: 3.17-beta1
Step up your Open Source Security Game with Mend here
Vulnerable Library - poi-3.8.jarApache POI - Java API To Access Microsoft Format Files
Library home page: http://poi.apache.org/
Path to dependency file: borelesgamuwaMedical/build.gradle
Path to vulnerable library: canner/.gradle/caches/modules-2/files-2.1/org.apache.poi/poi/3.8/552a7703d32c57adb611df084b45f7158e8653f3/poi-3.8.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Vulnerability Details
The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
Publish Date: 2012-08-07
URL: CVE-2012-0213
CVSS 2 Score Details (5.0)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0213
Release Date: 2012-08-07
Fix Resolution: org.apache.poi:poi-scratchpad:3.9,org.apache.poi:poi:3.9
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - dom4j-2.1.1.jarflexible XML framework for Java
Library home page: http://dom4j.github.io/
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.dom4j/dom4j/2.1.1/3dce5dbb3571aa820c677fadd8349bfa8f00c199/dom4j-2.1.1.jar
Dependency Hierarchy:
Found in HEAD commit: 45ace37d8116e8a7c24b3887f6ff69c6b2ef934c
Found in base branch: master
Vulnerability Details
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Publish Date: 2020-05-01
URL: CVE-2020-10683
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2020-05-01
Fix Resolution (org.dom4j:dom4j): 2.1.3
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-jpa): 2.2.7.RELEASE
Step up your Open Source Security Game with Mend here
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.