Vulnerabilities > Vmware > Spring Boot

DATE CVE VULNERABILITY TITLE RISK
2023-11-28 CVE-2023-34055 Unspecified vulnerability in VMWare Spring Boot
In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * org.springframework.boot:spring-boot-actuator is on the classpath
network
low complexity
vmware
6.5
2023-05-26 CVE-2023-20883 Resource Exhaustion vulnerability in VMWare Spring Boot
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
network
low complexity
vmware CWE-400
7.5
2023-04-20 CVE-2023-20873 Unspecified vulnerability in VMWare Spring Boot
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass.
network
low complexity
vmware
critical
9.8
2023-01-14 CVE-2023-22602 When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques.
network
low complexity
apache vmware
7.5
2022-03-30 CVE-2022-27772 Exposure of Resource to Wrong Sphere vulnerability in VMWare Spring Boot
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking.
local
low complexity
vmware CWE-668
7.8
2021-03-15 CVE-2021-26987 Element Plug-in for vCenter Server incorporates SpringBoot Framework.
network
low complexity
vmware netapp
critical
9.8
2018-03-19 CVE-2018-1196 Link Following vulnerability in VMWare Spring Boot
Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service.
network
high complexity
vmware CWE-59
5.9
2018-01-04 CVE-2017-8046 Improper Input Validation vulnerability in multiple products
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
network
low complexity
vmware pivotal-software CWE-20
critical
9.8