Search
Find a vulnerability
Search criteria
19 vulnerabilities by springsource
VAR-201005-0325
Vulnerability from variot - Updated: 2025-04-11 23:15com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password. SpringSource tc Server is a Tomcat-based web application server released by the vmware subsidiary. com.springsource.tcserver.serviceability.rmi.JmxSocketListener has security issues. If the Listener uses a password-encrypted configuration (such as adding s2enc:// before the password), then you can verify successful access to JMX regardless of whether you enter the correct password or an empty string. interface. By default, the JMX interface does not allow remote access, but it can be configured to be remotely accessible by setting the address property. An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access to the JMX interface, which may lead to further attacks. Versions prior to SpringSource tc Server runtime 6.0.20.D and 6.0.25.A-SR01 are vulnerable.
Mitigation: All users are recommended to immediately switch to non-encrypted passwords for the JMX interface or to disable the JMX interface.
References: [1] http://www.springsource.com/security/tc-server
Mark Thomas SpringSource Security Team . ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
http://secunia.com/company/jobs/
TITLE: SpringSource tc Server Encrypted Password Security Bypass
SECUNIA ADVISORY ID: SA39778
VERIFY ADVISORY: http://secunia.com/advisories/39778/
DESCRIPTION: A vulnerability has been reported in SpringSource tc Server, which can be exploited by malicious, local users to bypass certain security restrictions.
The vulnerability is caused due to an error within the com.springsource.tcserver.serviceability.rmi.JmxSocketListener listener when handling encrypted passwords. This can be exploited to bypass the authentication by e.g. entering an empty password.
PROVIDED AND/OR DISCOVERED BY: The vendor credits Erhan Baz, Yapi Kredi.
ORIGINAL ADVISORY: http://www.springsource.com/security/cve-2010-1454
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.19"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.20.b"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.20.c"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.19.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.25.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 1.6,
"vendor": "vmware",
"version": "6.0.20.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.19.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.20.a"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.20.b"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.20.c"
},
{
"_id": null,
"model": "tc server",
"scope": "eq",
"trust": 0.8,
"vendor": "vmware",
"version": "runtime 6.0.25.a"
},
{
"_id": null,
"model": "springsource tc server .a",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.19"
},
{
"_id": null,
"model": "springsource tc server .a",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "springsource tc server .a-sr1",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "springsource tc server .b",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "springsource tc server .c",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.20"
},
{
"_id": null,
"model": "springsource tc server .a",
"scope": "eq",
"trust": 0.6,
"vendor": "vmware",
"version": "6.0.25"
},
{
"_id": null,
"model": "tc server .a",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.25"
},
{
"_id": null,
"model": "tc server .c",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server .b",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server .a-sr1",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server .a",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
},
{
"_id": null,
"model": "tc server .a",
"scope": "eq",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.19"
},
{
"_id": null,
"model": "tc server .a-sr01",
"scope": "ne",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.25"
},
{
"_id": null,
"model": "tc server .d",
"scope": "ne",
"trust": 0.3,
"vendor": "springsource",
"version": "6.0.20"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "BID",
"id": "40205"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:vmware:tc_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
}
]
},
"credits": {
"_id": null,
"data": "Erhan Baz at Yapi Kredi",
"sources": [
{
"db": "BID",
"id": "40205"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
}
],
"trust": 0.9
},
"cve": "CVE-2010-1454",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2010-1454",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2010-1454",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2010-1454",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201005-251",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"description": {
"_id": null,
"data": "com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password. SpringSource tc Server is a Tomcat-based web application server released by the vmware subsidiary. com.springsource.tcserver.serviceability.rmi.JmxSocketListener has security issues. If the Listener uses a password-encrypted configuration (such as adding s2enc:// before the password), then you can verify successful access to JMX regardless of whether you enter the correct password or an empty string. interface. By default, the JMX interface does not allow remote access, but it can be configured to be remotely accessible by setting the address property. \nAn attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access to the JMX interface, which may lead to further attacks. \nVersions prior to SpringSource tc Server runtime 6.0.20.D and 6.0.25.A-SR01 are vulnerable. \n\nMitigation:\nAll users are recommended to immediately switch to non-encrypted passwords for the JMX interface or to disable the JMX interface. \n\nReferences:\n[1] http://www.springsource.com/security/tc-server\n\nMark Thomas\nSpringSource Security Team\n. ----------------------------------------------------------------------\n\n\nLooking for a job?\n\n\nSecunia is hiring skilled researchers and talented developers. \n\n\nhttp://secunia.com/company/jobs/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nSpringSource tc Server Encrypted Password Security Bypass\n\nSECUNIA ADVISORY ID:\nSA39778\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/39778/\n\nDESCRIPTION:\nA vulnerability has been reported in SpringSource tc Server, which\ncan be exploited by malicious, local users to bypass certain security\nrestrictions. \n\nThe vulnerability is caused due to an error within the\ncom.springsource.tcserver.serviceability.rmi.JmxSocketListener\nlistener when handling encrypted passwords. This can be exploited to\nbypass the authentication by e.g. entering an empty password. \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Erhan Baz, Yapi Kredi. \n\nORIGINAL ADVISORY:\nhttp://www.springsource.com/security/cve-2010-1454\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-1454"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "BID",
"id": "40205"
},
{
"db": "PACKETSTORM",
"id": "89655"
},
{
"db": "PACKETSTORM",
"id": "89613"
}
],
"trust": 2.61
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2010-1454",
"trust": 3.5
},
{
"db": "BID",
"id": "40205",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "39778",
"trust": 2.6
},
{
"db": "XF",
"id": "58684",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2010-0888",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20100517 CVE-2010-1454: SPRINGSOURCE TC SERVER UNAUTHENTICATED REMOTE ACCESS TO JMX INTERFACE",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "15045",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "89655",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "89613",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "BID",
"id": "40205"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "PACKETSTORM",
"id": "89655"
},
{
"db": "PACKETSTORM",
"id": "89613"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"id": "VAR-201005-0325",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
}
]
},
"last_update_date": "2025-04-11T23:15:42.515000Z",
"patch": {
"_id": null,
"data": [
{
"title": "CVE-2010-1454",
"trust": 0.8,
"url": "http://www.springsource.com/security/cve-2010-1454"
},
{
"title": "SpringSource tc Server JMX interface verification security bypass patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/415"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-287",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.6,
"url": "http://www.springsource.com/security/cve-2010-1454"
},
{
"trust": 2.4,
"url": "http://secunia.com/advisories/39778"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/40205"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/archive/1/511307/100/0/threaded"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58684"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1454"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/xforce/xfdb/58684"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-1454"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/511307/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/15045"
},
{
"trust": 0.3,
"url": "http://www.springsource.com/"
},
{
"trust": 0.3,
"url": "/archive/1/511307"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1454"
},
{
"trust": 0.1,
"url": "http://www.springsource.com/security/tc-server"
},
{
"trust": 0.1,
"url": "http://secunia.com/company/jobs/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/39778/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2010-0888"
},
{
"db": "BID",
"id": "40205"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
},
{
"db": "PACKETSTORM",
"id": "89655"
},
{
"db": "PACKETSTORM",
"id": "89613"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
},
{
"db": "NVD",
"id": "CVE-2010-1454"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CNVD",
"id": "CNVD-2010-0888",
"ident": null
},
{
"db": "BID",
"id": "40205",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001996",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "89655",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "89613",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2010-1454",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2010-05-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2010-0888",
"ident": null
},
{
"date": "2010-05-17T00:00:00",
"db": "BID",
"id": "40205",
"ident": null
},
{
"date": "2010-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001996",
"ident": null
},
{
"date": "2010-05-19T04:23:49",
"db": "PACKETSTORM",
"id": "89655",
"ident": null
},
{
"date": "2010-05-18T15:00:23",
"db": "PACKETSTORM",
"id": "89613",
"ident": null
},
{
"date": "2010-05-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201005-251",
"ident": null
},
{
"date": "2010-05-19T18:30:03.553000",
"db": "NVD",
"id": "CVE-2010-1454",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2010-05-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2010-0888",
"ident": null
},
{
"date": "2010-05-17T00:00:00",
"db": "BID",
"id": "40205",
"ident": null
},
{
"date": "2010-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001996",
"ident": null
},
{
"date": "2010-05-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201005-251",
"ident": null
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2010-1454",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "89655"
},
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
}
],
"trust": 0.7
},
"title": {
"_id": null,
"data": "VMware SpringSource tc Server Runtime In JMX Vulnerability to gain access to the interface",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001996"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201005-251"
}
],
"trust": 0.6
}
}
CVE-2014-0054 (GCVE-0-2014-0054)
Vulnerability from nvd – Published: 2014-04-17 14:00 – Updated: 2024-08-06 09:05
VLAI
EPSS
VEX
Summary
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/66148 | vdb-entryx_refsource_BID |
| https://jira.spring.io/browse/SPR-11376 | x_refsource_CONFIRM |
| http://www.oracle.com/technetwork/security-adviso… | x_refsource_CONFIRM |
| http://rhn.redhat.com/errata/RHSA-2014-0400.html | vendor-advisoryx_refsource_REDHAT |
| http://secunia.com/advisories/57915 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2014-01-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:05:38.783Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "66148",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/66148"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://jira.spring.io/browse/SPR-11376"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
},
{
"name": "RHSA-2014:0400",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "57915",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/57915"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-01-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-19T01:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "66148",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/66148"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://jira.spring.io/browse/SPR-11376"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
},
{
"name": "RHSA-2014:0400",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "57915",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/57915"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0054",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "66148",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/66148"
},
{
"name": "https://jira.spring.io/browse/SPR-11376",
"refsource": "CONFIRM",
"url": "https://jira.spring.io/browse/SPR-11376"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
},
{
"name": "RHSA-2014:0400",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "57915",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/57915"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0054",
"datePublished": "2014-04-17T14:00:00.000Z",
"dateReserved": "2013-12-03T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:05:38.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7315 (GCVE-0-2013-7315)
Vulnerability from nvd – Published: 2014-01-23 21:00 – Updated: 2024-08-06 18:01
VLAI
EPSS
VEX
Summary
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.gopivotal.com/security/cve-2013-4152 | x_refsource_CONFIRM |
| http://seclists.org/fulldisclosure/2013/Nov/14 | mailing-listx_refsource_FULLDISC |
| http://seclists.org/bugtraq/2013/Aug/154 | mailing-listx_refsource_BUGTRAQ |
| http://www.debian.org/security/2014/dsa-2842 | vendor-advisoryx_refsource_DEBIAN |
| http://www.securityfocus.com/bid/77998 | vdb-entryx_refsource_BID |
| https://jira.springsource.org/browse/SPR-10806 | x_refsource_CONFIRM |
Date Public
2013-08-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "77998",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/77998"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://jira.springsource.org/browse/SPR-10806"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "77998",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/77998"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://jira.springsource.org/browse/SPR-10806"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7315",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.gopivotal.com/security/cve-2013-4152",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "77998",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/77998"
},
{
"name": "https://jira.springsource.org/browse/SPR-10806",
"refsource": "CONFIRM",
"url": "https://jira.springsource.org/browse/SPR-10806"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7315",
"datePublished": "2014-01-23T21:00:00.000Z",
"dateReserved": "2014-01-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T18:01:20.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4152 (GCVE-0-2013-4152)
Vulnerability from nvd – Published: 2014-01-23 21:00 – Updated: 2024-08-06 16:30
VLAI
EPSS
VEX
Summary
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/spring-projects/spring-framewo… | x_refsource_CONFIRM |
| http://www.gopivotal.com/security/cve-2013-4152 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/61951 | vdb-entryx_refsource_BID |
| http://seclists.org/fulldisclosure/2013/Nov/14 | mailing-listx_refsource_FULLDISC |
| http://rhn.redhat.com/errata/RHSA-2014-0254.html | vendor-advisoryx_refsource_REDHAT |
| http://seclists.org/bugtraq/2013/Aug/154 | mailing-listx_refsource_BUGTRAQ |
| http://www.debian.org/security/2014/dsa-2842 | vendor-advisoryx_refsource_DEBIAN |
| http://rhn.redhat.com/errata/RHSA-2014-0212.html | vendor-advisoryx_refsource_REDHAT |
| http://rhn.redhat.com/errata/RHSA-2014-0400.html | vendor-advisoryx_refsource_REDHAT |
| http://rhn.redhat.com/errata/RHSA-2014-0245.html | vendor-advisoryx_refsource_REDHAT |
| http://secunia.com/advisories/57915 | third-party-advisoryx_refsource_SECUNIA |
| https://jira.springsource.org/browse/SPR-10806 | x_refsource_CONFIRM |
| http://secunia.com/advisories/56247 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2013-08-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:30:49.922Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/spring-projects/spring-framework/pull/317/files"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "61951",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61951"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "RHSA-2014:0254",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0254.html"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "RHSA-2014:0212",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0212.html"
},
{
"name": "RHSA-2014:0400",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "RHSA-2014:0245",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0245.html"
},
{
"name": "57915",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/57915"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://jira.springsource.org/browse/SPR-10806"
},
{
"name": "56247",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56247"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T19:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/spring-projects/spring-framework/pull/317/files"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "61951",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61951"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "RHSA-2014:0254",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0254.html"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "RHSA-2014:0212",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0212.html"
},
{
"name": "RHSA-2014:0400",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "RHSA-2014:0245",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0245.html"
},
{
"name": "57915",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/57915"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://jira.springsource.org/browse/SPR-10806"
},
{
"name": "56247",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56247"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-4152",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/spring-projects/spring-framework/pull/317/files",
"refsource": "CONFIRM",
"url": "https://github.com/spring-projects/spring-framework/pull/317/files"
},
{
"name": "http://www.gopivotal.com/security/cve-2013-4152",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "61951",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61951"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "RHSA-2014:0254",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0254.html"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "RHSA-2014:0212",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0212.html"
},
{
"name": "RHSA-2014:0400",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "RHSA-2014:0245",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0245.html"
},
{
"name": "57915",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/57915"
},
{
"name": "https://jira.springsource.org/browse/SPR-10806",
"refsource": "CONFIRM",
"url": "https://jira.springsource.org/browse/SPR-10806"
},
{
"name": "56247",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56247"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4152",
"datePublished": "2014-01-23T21:00:00.000Z",
"dateReserved": "2013-06-12T00:00:00.000Z",
"dateUpdated": "2024-08-06T16:30:49.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-2730 (GCVE-0-2011-2730)
Vulnerability from nvd – Published: 2012-12-05 17:00 – Updated: 2024-08-06 23:08
VLAI
EPSS
VEX
Summary
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
19 references
Date Public
2011-09-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:08:23.793Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.springsource.com/security/cve-2011-2730"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814"
},
{
"name": "RHSA-2013:0192",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
},
{
"name": "RHSA-2013:0198",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
},
{
"name": "RHSA-2013:0195",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
},
{
"name": "RHSA-2013:0221",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
},
{
"name": "DSA-2504",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2504"
},
{
"name": "RHSA-2013:0196",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
},
{
"name": "55155",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/55155"
},
{
"name": "RHSA-2013:0193",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
},
{
"name": "51984",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51984"
},
{
"name": "52054",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52054"
},
{
"name": "RHSA-2013:0191",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
},
{
"name": "RHSA-2013:0533",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
},
{
"name": "RHSA-2013:0197",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"name": "1029151",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1029151"
},
{
"name": "RHSA-2013:0194",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka \"Expression Language Injection.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-08T16:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.springsource.com/security/cve-2011-2730"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814"
},
{
"name": "RHSA-2013:0192",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
},
{
"name": "RHSA-2013:0198",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
},
{
"name": "RHSA-2013:0195",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
},
{
"name": "RHSA-2013:0221",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
},
{
"name": "DSA-2504",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2504"
},
{
"name": "RHSA-2013:0196",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
},
{
"name": "55155",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/55155"
},
{
"name": "RHSA-2013:0193",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
},
{
"name": "51984",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51984"
},
{
"name": "52054",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52054"
},
{
"name": "RHSA-2013:0191",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
},
{
"name": "RHSA-2013:0533",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
},
{
"name": "RHSA-2013:0197",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"name": "1029151",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1029151"
},
{
"name": "RHSA-2013:0194",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2730",
"datePublished": "2012-12-05T17:00:00.000Z",
"dateReserved": "2011-07-11T00:00:00.000Z",
"dateUpdated": "2024-08-06T23:08:23.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1833 (GCVE-0-2012-1833)
Vulnerability from nvd – Published: 2012-09-28 21:00 – Updated: 2024-08-06 19:08
VLAI
EPSS
VEX
Summary
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/51113 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/55763 | vdb-entryx_refsource_BID |
| http://support.springsource.com/security/cve-2012-1833 | x_refsource_CONFIRM |
Date Public
2012-08-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:08:38.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "51113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/55763"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-02-12T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "51113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/55763"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1833",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "51113",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/55763"
},
{
"name": "http://support.springsource.com/security/cve-2012-1833",
"refsource": "CONFIRM",
"url": "http://support.springsource.com/security/cve-2012-1833"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1833",
"datePublished": "2012-09-28T21:00:00.000Z",
"dateReserved": "2012-03-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T19:08:38.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-1622 (GCVE-0-2010-1622)
Vulnerability from nvd – Published: 2010-06-21 16:00 – Updated: 2024-08-07 01:28
VLAI
EPSS
VEX
Summary
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
14 references
Date Public
2010-06-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T01:28:42.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html"
},
{
"name": "ADV-2011-0237",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0237"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"
},
{
"name": "13918",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/13918"
},
{
"name": "43087",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43087"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.springsource.com/security/cve-2010-1622"
},
{
"name": "41025",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41025"
},
{
"name": "RHSA-2011:0175",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0175.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://geronimo.apache.org/22x-security-report.html"
},
{
"name": "40954",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40954"
},
{
"name": "41016",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41016"
},
{
"name": "1033898",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1033898"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://geronimo.apache.org/21x-security-report.html"
},
{
"name": "20100618 CVE-2010-1622: Spring Framework execution of arbitrary code",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/511877"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-06-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-05T21:57:02.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html"
},
{
"name": "ADV-2011-0237",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0237"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"
},
{
"name": "13918",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/13918"
},
{
"name": "43087",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43087"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.springsource.com/security/cve-2010-1622"
},
{
"name": "41025",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41025"
},
{
"name": "RHSA-2011:0175",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0175.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://geronimo.apache.org/22x-security-report.html"
},
{
"name": "40954",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40954"
},
{
"name": "41016",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41016"
},
{
"name": "1033898",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1033898"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://geronimo.apache.org/21x-security-report.html"
},
{
"name": "20100618 CVE-2010-1622: Spring Framework execution of arbitrary code",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/511877"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-1622",
"datePublished": "2010-06-21T16:00:00.000Z",
"dateReserved": "2010-04-29T00:00:00.000Z",
"dateUpdated": "2024-08-07T01:28:42.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2907 (GCVE-0-2009-2907)
Vulnerability from nvd – Published: 2010-03-24 18:00 – Updated: 2024-09-16 19:10
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified "input fields."
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/38913 | vdb-entryx_refsource_BID |
| http://www.springsource.com/security/cve-2009-2907 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.185Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "38913",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/38913"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.springsource.com/security/cve-2009-2907"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified \"input fields.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-03-24T18:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "38913",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/38913"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.springsource.com/security/cve-2009-2907"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2009-2907",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified \"input fields.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "38913",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/38913"
},
{
"name": "http://www.springsource.com/security/cve-2009-2907",
"refsource": "CONFIRM",
"url": "http://www.springsource.com/security/cve-2009-2907"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2009-2907",
"datePublished": "2010-03-24T18:00:00.000Z",
"dateReserved": "2009-08-20T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:10:18.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2898 (GCVE-0-2009-2898)
Vulnerability from nvd – Published: 2009-10-13 10:00 – Updated: 2024-08-07 06:07
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/58611 | vdb-entryx_refsource_OSVDB |
| http://www.coresecurity.com/content/hyperic-hq-vu… | x_refsource_MISC |
| http://corelabs.coresecurity.com/index.php?module… | x_refsource_MISC |
| http://jira.hyperic.com/browse/HHQ-3390 | x_refsource_CONFIRM |
| http://www.securityfocus.com/archive/1/506950/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/archive/1/506935/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.springsource.com/security/hyperic-hq | x_refsource_CONFIRM |
| http://secunia.com/advisories/36935 | third-party-advisoryx_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2009-10-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.196Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "58611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/58611"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.hyperic.com/browse/HHQ-3390"
},
{
"name": "20091002 CVE-2009-2898: Hyperic HQ - Stored XSS in alerts list",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/506950/100/0/threaded"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-description-xss(53660)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53660"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "58611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/58611"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.hyperic.com/browse/HHQ-3390"
},
{
"name": "20091002 CVE-2009-2898: Hyperic HQ - Stored XSS in alerts list",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/506950/100/0/threaded"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-description-xss(53660)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53660"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2009-2898",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "58611",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/58611"
},
{
"name": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities",
"refsource": "MISC",
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"name": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS",
"refsource": "MISC",
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"name": "http://jira.hyperic.com/browse/HHQ-3390",
"refsource": "CONFIRM",
"url": "http://jira.hyperic.com/browse/HHQ-3390"
},
{
"name": "20091002 CVE-2009-2898: Hyperic HQ - Stored XSS in alerts list",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/506950/100/0/threaded"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"name": "http://www.springsource.com/security/hyperic-hq",
"refsource": "CONFIRM",
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-description-xss(53660)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53660"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2009-2898",
"datePublished": "2009-10-13T10:00:00.000Z",
"dateReserved": "2009-08-20T00:00:00.000Z",
"dateUpdated": "2024-08-07T06:07:37.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2897 (GCVE-0-2009-2897)
Vulnerability from nvd – Published: 2009-10-13 10:00 – Updated: 2024-08-07 06:07
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
12 references
| URL | Tags |
|---|---|
| http://www.coresecurity.com/content/hyperic-hq-vu… | x_refsource_MISC |
| http://corelabs.coresecurity.com/index.php?module… | x_refsource_MISC |
| http://www.osvdb.org/58609 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/506935/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.springsource.com/security/hyperic-hq | x_refsource_CONFIRM |
| http://secunia.com/advisories/36935 | third-party-advisoryx_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.osvdb.org/58610 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/506936/100… | mailing-listx_refsource_BUGTRAQ |
| http://jira.hyperic.com/browse/HHQ-2655 | x_refsource_CONFIRM |
| http://forums.hyperic.com/jiveforums/thread.jspa?… | x_refsource_CONFIRM |
| http://www.osvdb.org/58608 | vdb-entryx_refsource_OSVDB |
Date Public
2009-10-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.310Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"name": "58609",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/58609"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-mastheadattach-xss(53658)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53658"
},
{
"name": "58610",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/58610"
},
{
"name": "20091002 CVE-2009-2897: Hyperic HQ - Reflected XSS in stack trace",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/506936/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.hyperic.com/browse/HHQ-2655"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156\u0026#22156"
},
{
"name": "58608",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/58608"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"name": "58609",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/58609"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-mastheadattach-xss(53658)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53658"
},
{
"name": "58610",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/58610"
},
{
"name": "20091002 CVE-2009-2897: Hyperic HQ - Reflected XSS in stack trace",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/506936/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.hyperic.com/browse/HHQ-2655"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156\u0026#22156"
},
{
"name": "58608",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/58608"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2009-2897",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities",
"refsource": "MISC",
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"name": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS",
"refsource": "MISC",
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"name": "58609",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/58609"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"name": "http://www.springsource.com/security/hyperic-hq",
"refsource": "CONFIRM",
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-mastheadattach-xss(53658)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53658"
},
{
"name": "58610",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/58610"
},
{
"name": "20091002 CVE-2009-2897: Hyperic HQ - Reflected XSS in stack trace",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/506936/100/0/threaded"
},
{
"name": "http://jira.hyperic.com/browse/HHQ-2655",
"refsource": "CONFIRM",
"url": "http://jira.hyperic.com/browse/HHQ-2655"
},
{
"name": "http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156\u0026#22156",
"refsource": "CONFIRM",
"url": "http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156\u0026#22156"
},
{
"name": "58608",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/58608"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2009-2897",
"datePublished": "2009-10-13T10:00:00.000Z",
"dateReserved": "2009-08-20T00:00:00.000Z",
"dateUpdated": "2024-08-07T06:07:37.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-0054 (GCVE-0-2014-0054)
Vulnerability from cvelistv5 – Published: 2014-04-17 14:00 – Updated: 2024-08-06 09:05
VLAI
EPSS
VEX
Summary
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/66148 | vdb-entryx_refsource_BID |
| https://jira.spring.io/browse/SPR-11376 | x_refsource_CONFIRM |
| http://www.oracle.com/technetwork/security-adviso… | x_refsource_CONFIRM |
| http://rhn.redhat.com/errata/RHSA-2014-0400.html | vendor-advisoryx_refsource_REDHAT |
| http://secunia.com/advisories/57915 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2014-01-31 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:05:38.783Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "66148",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/66148"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://jira.spring.io/browse/SPR-11376"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
},
{
"name": "RHSA-2014:0400",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "57915",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/57915"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-01-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-19T01:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "66148",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/66148"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://jira.spring.io/browse/SPR-11376"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
},
{
"name": "RHSA-2014:0400",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "57915",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/57915"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0054",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "66148",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/66148"
},
{
"name": "https://jira.spring.io/browse/SPR-11376",
"refsource": "CONFIRM",
"url": "https://jira.spring.io/browse/SPR-11376"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
},
{
"name": "RHSA-2014:0400",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "57915",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/57915"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0054",
"datePublished": "2014-04-17T14:00:00.000Z",
"dateReserved": "2013-12-03T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:05:38.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7315 (GCVE-0-2013-7315)
Vulnerability from cvelistv5 – Published: 2014-01-23 21:00 – Updated: 2024-08-06 18:01
VLAI
EPSS
VEX
Summary
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.gopivotal.com/security/cve-2013-4152 | x_refsource_CONFIRM |
| http://seclists.org/fulldisclosure/2013/Nov/14 | mailing-listx_refsource_FULLDISC |
| http://seclists.org/bugtraq/2013/Aug/154 | mailing-listx_refsource_BUGTRAQ |
| http://www.debian.org/security/2014/dsa-2842 | vendor-advisoryx_refsource_DEBIAN |
| http://www.securityfocus.com/bid/77998 | vdb-entryx_refsource_BID |
| https://jira.springsource.org/browse/SPR-10806 | x_refsource_CONFIRM |
Date Public
2013-08-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "77998",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/77998"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://jira.springsource.org/browse/SPR-10806"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "77998",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/77998"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://jira.springsource.org/browse/SPR-10806"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7315",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.gopivotal.com/security/cve-2013-4152",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "77998",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/77998"
},
{
"name": "https://jira.springsource.org/browse/SPR-10806",
"refsource": "CONFIRM",
"url": "https://jira.springsource.org/browse/SPR-10806"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7315",
"datePublished": "2014-01-23T21:00:00.000Z",
"dateReserved": "2014-01-23T00:00:00.000Z",
"dateUpdated": "2024-08-06T18:01:20.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4152 (GCVE-0-2013-4152)
Vulnerability from cvelistv5 – Published: 2014-01-23 21:00 – Updated: 2024-08-06 16:30
VLAI
EPSS
VEX
Summary
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/spring-projects/spring-framewo… | x_refsource_CONFIRM |
| http://www.gopivotal.com/security/cve-2013-4152 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/61951 | vdb-entryx_refsource_BID |
| http://seclists.org/fulldisclosure/2013/Nov/14 | mailing-listx_refsource_FULLDISC |
| http://rhn.redhat.com/errata/RHSA-2014-0254.html | vendor-advisoryx_refsource_REDHAT |
| http://seclists.org/bugtraq/2013/Aug/154 | mailing-listx_refsource_BUGTRAQ |
| http://www.debian.org/security/2014/dsa-2842 | vendor-advisoryx_refsource_DEBIAN |
| http://rhn.redhat.com/errata/RHSA-2014-0212.html | vendor-advisoryx_refsource_REDHAT |
| http://rhn.redhat.com/errata/RHSA-2014-0400.html | vendor-advisoryx_refsource_REDHAT |
| http://rhn.redhat.com/errata/RHSA-2014-0245.html | vendor-advisoryx_refsource_REDHAT |
| http://secunia.com/advisories/57915 | third-party-advisoryx_refsource_SECUNIA |
| https://jira.springsource.org/browse/SPR-10806 | x_refsource_CONFIRM |
| http://secunia.com/advisories/56247 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2013-08-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:30:49.922Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/spring-projects/spring-framework/pull/317/files"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "61951",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61951"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "RHSA-2014:0254",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0254.html"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "RHSA-2014:0212",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0212.html"
},
{
"name": "RHSA-2014:0400",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "RHSA-2014:0245",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0245.html"
},
{
"name": "57915",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/57915"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://jira.springsource.org/browse/SPR-10806"
},
{
"name": "56247",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56247"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T19:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/spring-projects/spring-framework/pull/317/files"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "61951",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61951"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "RHSA-2014:0254",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0254.html"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "RHSA-2014:0212",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0212.html"
},
{
"name": "RHSA-2014:0400",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "RHSA-2014:0245",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0245.html"
},
{
"name": "57915",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/57915"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://jira.springsource.org/browse/SPR-10806"
},
{
"name": "56247",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56247"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-4152",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/spring-projects/spring-framework/pull/317/files",
"refsource": "CONFIRM",
"url": "https://github.com/spring-projects/spring-framework/pull/317/files"
},
{
"name": "http://www.gopivotal.com/security/cve-2013-4152",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2013-4152"
},
{
"name": "61951",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61951"
},
{
"name": "20131102 XXE Injection in Spring Framework",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2013/Nov/14"
},
{
"name": "RHSA-2014:0254",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0254.html"
},
{
"name": "20130822 CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2013/Aug/154"
},
{
"name": "DSA-2842",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2014/dsa-2842"
},
{
"name": "RHSA-2014:0212",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0212.html"
},
{
"name": "RHSA-2014:0400",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0400.html"
},
{
"name": "RHSA-2014:0245",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0245.html"
},
{
"name": "57915",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/57915"
},
{
"name": "https://jira.springsource.org/browse/SPR-10806",
"refsource": "CONFIRM",
"url": "https://jira.springsource.org/browse/SPR-10806"
},
{
"name": "56247",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56247"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4152",
"datePublished": "2014-01-23T21:00:00.000Z",
"dateReserved": "2013-06-12T00:00:00.000Z",
"dateUpdated": "2024-08-06T16:30:49.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-2730 (GCVE-0-2011-2730)
Vulnerability from cvelistv5 – Published: 2012-12-05 17:00 – Updated: 2024-08-06 23:08
VLAI
EPSS
VEX
Summary
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
19 references
Date Public
2011-09-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:08:23.793Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.springsource.com/security/cve-2011-2730"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814"
},
{
"name": "RHSA-2013:0192",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
},
{
"name": "RHSA-2013:0198",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
},
{
"name": "RHSA-2013:0195",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
},
{
"name": "RHSA-2013:0221",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
},
{
"name": "DSA-2504",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2504"
},
{
"name": "RHSA-2013:0196",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
},
{
"name": "55155",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/55155"
},
{
"name": "RHSA-2013:0193",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
},
{
"name": "51984",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51984"
},
{
"name": "52054",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52054"
},
{
"name": "RHSA-2013:0191",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
},
{
"name": "RHSA-2013:0533",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
},
{
"name": "RHSA-2013:0197",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"name": "1029151",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1029151"
},
{
"name": "RHSA-2013:0194",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka \"Expression Language Injection.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-08T16:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.springsource.com/security/cve-2011-2730"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814"
},
{
"name": "RHSA-2013:0192",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0192.html"
},
{
"name": "RHSA-2013:0198",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0198.html"
},
{
"name": "RHSA-2013:0195",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0195.html"
},
{
"name": "RHSA-2013:0221",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0221.html"
},
{
"name": "DSA-2504",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2504"
},
{
"name": "RHSA-2013:0196",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0196.html"
},
{
"name": "55155",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/55155"
},
{
"name": "RHSA-2013:0193",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0193.html"
},
{
"name": "51984",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51984"
},
{
"name": "52054",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52054"
},
{
"name": "RHSA-2013:0191",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0191.html"
},
{
"name": "RHSA-2013:0533",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0533.html"
},
{
"name": "RHSA-2013:0197",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0197.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"name": "1029151",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1029151"
},
{
"name": "RHSA-2013:0194",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0194.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2730",
"datePublished": "2012-12-05T17:00:00.000Z",
"dateReserved": "2011-07-11T00:00:00.000Z",
"dateUpdated": "2024-08-06T23:08:23.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1833 (GCVE-0-2012-1833)
Vulnerability from cvelistv5 – Published: 2012-09-28 21:00 – Updated: 2024-08-06 19:08
VLAI
EPSS
VEX
Summary
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/51113 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/55763 | vdb-entryx_refsource_BID |
| http://support.springsource.com/security/cve-2012-1833 | x_refsource_CONFIRM |
Date Public
2012-08-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:08:38.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "51113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/55763"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-02-12T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "51113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/55763"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1833",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "51113",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/55763"
},
{
"name": "http://support.springsource.com/security/cve-2012-1833",
"refsource": "CONFIRM",
"url": "http://support.springsource.com/security/cve-2012-1833"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1833",
"datePublished": "2012-09-28T21:00:00.000Z",
"dateReserved": "2012-03-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T19:08:38.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-1622 (GCVE-0-2010-1622)
Vulnerability from cvelistv5 – Published: 2010-06-21 16:00 – Updated: 2024-08-07 01:28
VLAI
EPSS
VEX
Summary
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
14 references
Date Public
2010-06-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T01:28:42.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html"
},
{
"name": "ADV-2011-0237",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0237"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"
},
{
"name": "13918",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/13918"
},
{
"name": "43087",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43087"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.springsource.com/security/cve-2010-1622"
},
{
"name": "41025",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41025"
},
{
"name": "RHSA-2011:0175",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0175.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://geronimo.apache.org/22x-security-report.html"
},
{
"name": "40954",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40954"
},
{
"name": "41016",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41016"
},
{
"name": "1033898",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1033898"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://geronimo.apache.org/21x-security-report.html"
},
{
"name": "20100618 CVE-2010-1622: Spring Framework execution of arbitrary code",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/511877"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-06-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-05T21:57:02.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html"
},
{
"name": "ADV-2011-0237",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0237"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"
},
{
"name": "13918",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/13918"
},
{
"name": "43087",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43087"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.springsource.com/security/cve-2010-1622"
},
{
"name": "41025",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41025"
},
{
"name": "RHSA-2011:0175",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2011-0175.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://geronimo.apache.org/22x-security-report.html"
},
{
"name": "40954",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40954"
},
{
"name": "41016",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41016"
},
{
"name": "1033898",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1033898"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://geronimo.apache.org/21x-security-report.html"
},
{
"name": "20100618 CVE-2010-1622: Spring Framework execution of arbitrary code",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/511877"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-1622",
"datePublished": "2010-06-21T16:00:00.000Z",
"dateReserved": "2010-04-29T00:00:00.000Z",
"dateUpdated": "2024-08-07T01:28:42.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2907 (GCVE-0-2009-2907)
Vulnerability from cvelistv5 – Published: 2010-03-24 18:00 – Updated: 2024-09-16 19:10
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified "input fields."
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/38913 | vdb-entryx_refsource_BID |
| http://www.springsource.com/security/cve-2009-2907 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.185Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "38913",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/38913"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.springsource.com/security/cve-2009-2907"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified \"input fields.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-03-24T18:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "38913",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/38913"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.springsource.com/security/cve-2009-2907"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2009-2907",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified \"input fields.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "38913",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/38913"
},
{
"name": "http://www.springsource.com/security/cve-2009-2907",
"refsource": "CONFIRM",
"url": "http://www.springsource.com/security/cve-2009-2907"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2009-2907",
"datePublished": "2010-03-24T18:00:00.000Z",
"dateReserved": "2009-08-20T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:10:18.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2897 (GCVE-0-2009-2897)
Vulnerability from cvelistv5 – Published: 2009-10-13 10:00 – Updated: 2024-08-07 06:07
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
12 references
| URL | Tags |
|---|---|
| http://www.coresecurity.com/content/hyperic-hq-vu… | x_refsource_MISC |
| http://corelabs.coresecurity.com/index.php?module… | x_refsource_MISC |
| http://www.osvdb.org/58609 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/506935/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.springsource.com/security/hyperic-hq | x_refsource_CONFIRM |
| http://secunia.com/advisories/36935 | third-party-advisoryx_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.osvdb.org/58610 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/506936/100… | mailing-listx_refsource_BUGTRAQ |
| http://jira.hyperic.com/browse/HHQ-2655 | x_refsource_CONFIRM |
| http://forums.hyperic.com/jiveforums/thread.jspa?… | x_refsource_CONFIRM |
| http://www.osvdb.org/58608 | vdb-entryx_refsource_OSVDB |
Date Public
2009-10-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.310Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"name": "58609",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/58609"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-mastheadattach-xss(53658)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53658"
},
{
"name": "58610",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/58610"
},
{
"name": "20091002 CVE-2009-2897: Hyperic HQ - Reflected XSS in stack trace",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/506936/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.hyperic.com/browse/HHQ-2655"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156\u0026#22156"
},
{
"name": "58608",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/58608"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"name": "58609",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/58609"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-mastheadattach-xss(53658)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53658"
},
{
"name": "58610",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/58610"
},
{
"name": "20091002 CVE-2009-2897: Hyperic HQ - Reflected XSS in stack trace",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/506936/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.hyperic.com/browse/HHQ-2655"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156\u0026#22156"
},
{
"name": "58608",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/58608"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2009-2897",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities",
"refsource": "MISC",
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"name": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS",
"refsource": "MISC",
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"name": "58609",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/58609"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"name": "http://www.springsource.com/security/hyperic-hq",
"refsource": "CONFIRM",
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-mastheadattach-xss(53658)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53658"
},
{
"name": "58610",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/58610"
},
{
"name": "20091002 CVE-2009-2897: Hyperic HQ - Reflected XSS in stack trace",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/506936/100/0/threaded"
},
{
"name": "http://jira.hyperic.com/browse/HHQ-2655",
"refsource": "CONFIRM",
"url": "http://jira.hyperic.com/browse/HHQ-2655"
},
{
"name": "http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156\u0026#22156",
"refsource": "CONFIRM",
"url": "http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156\u0026#22156"
},
{
"name": "58608",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/58608"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2009-2897",
"datePublished": "2009-10-13T10:00:00.000Z",
"dateReserved": "2009-08-20T00:00:00.000Z",
"dateUpdated": "2024-08-07T06:07:37.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-2898 (GCVE-0-2009-2898)
Vulnerability from cvelistv5 – Published: 2009-10-13 10:00 – Updated: 2024-08-07 06:07
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/58611 | vdb-entryx_refsource_OSVDB |
| http://www.coresecurity.com/content/hyperic-hq-vu… | x_refsource_MISC |
| http://corelabs.coresecurity.com/index.php?module… | x_refsource_MISC |
| http://jira.hyperic.com/browse/HHQ-3390 | x_refsource_CONFIRM |
| http://www.securityfocus.com/archive/1/506950/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/archive/1/506935/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.springsource.com/security/hyperic-hq | x_refsource_CONFIRM |
| http://secunia.com/advisories/36935 | third-party-advisoryx_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2009-10-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:07:37.196Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "58611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/58611"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.hyperic.com/browse/HHQ-3390"
},
{
"name": "20091002 CVE-2009-2898: Hyperic HQ - Stored XSS in alerts list",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/506950/100/0/threaded"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-description-xss(53660)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53660"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "58611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/58611"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.hyperic.com/browse/HHQ-3390"
},
{
"name": "20091002 CVE-2009-2898: Hyperic HQ - Stored XSS in alerts list",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/506950/100/0/threaded"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-description-xss(53660)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53660"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2009-2898",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "58611",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/58611"
},
{
"name": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities",
"refsource": "MISC",
"url": "http://www.coresecurity.com/content/hyperic-hq-vulnerabilities"
},
{
"name": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS",
"refsource": "MISC",
"url": "http://corelabs.coresecurity.com/index.php?module=Wiki\u0026action=view\u0026type=advisory\u0026name=Hyperic_HQ_Multiple_XSS"
},
{
"name": "http://jira.hyperic.com/browse/HHQ-3390",
"refsource": "CONFIRM",
"url": "http://jira.hyperic.com/browse/HHQ-3390"
},
{
"name": "20091002 CVE-2009-2898: Hyperic HQ - Stored XSS in alerts list",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/506950/100/0/threaded"
},
{
"name": "20091003 CORE-2009-0812-Hyperic HQ Multiple XSS",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/506935/100/0/threaded"
},
{
"name": "http://www.springsource.com/security/hyperic-hq",
"refsource": "CONFIRM",
"url": "http://www.springsource.com/security/hyperic-hq"
},
{
"name": "36935",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/36935"
},
{
"name": "hyperichq-description-xss(53660)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53660"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2009-2898",
"datePublished": "2009-10-13T10:00:00.000Z",
"dateReserved": "2009-08-20T00:00:00.000Z",
"dateUpdated": "2024-08-07T06:07:37.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}