Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass

Element Plug-in for vCenter Server incorporates SpringBoot Framework

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to…

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under…

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a…

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking

Values produced by ${random.value} are not suitable for use as secrets

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if…

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass

A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server

When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the…

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS)…

Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service

Predictable Temp Directory in Artemis Auto-configuration

Mail Auto-Configuration Does Not Enable SSL Hostname Verification