Login Request a demo
SF
Product
Spring Framework
by Springsource · last CVE Apr 17, 2014
5
CVEs
0
On KEV
–
Max CVSS
0
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 0High 0Medium 0Low 0
Severity
All severities5Critical0High0Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Spring Framework to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2014-0054
–
91%
Apr 17
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote…
Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +13 more
CVE-2013-7315
–
5%
Jan 23
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows…
Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +9 more
CVE-2013-4152
–
26%
Jan 23
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers…
Affected: 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0; +9 more
CVE-2011-2730
–
12%
Dec 5
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags…
Affected: through 2.5.7_sr01; through 3.0.5; 2.5.0; 2.5.0; 2.5.0; 2.5.1; +11 more
CVE-2010-1622
–
52%
Jun 21
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request…
Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +5 more
Showing 5