Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-ggg2-9786-hwc8
  • Maven/org.springframework.boot:spring-boot-autoconfigure
 Spring Boot: Predictable Temp Directory in Artemis Auto-configuration 11 Jun
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-9wxp-w4px-32vh
  • Maven/org.springframework.boot:spring-boot-starter-mail
 Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification 11 Jun
  • Fix available
  • Severity - 5.0 (Medium)
GHSA-5368-6h4h-gr29
  • Maven/org.springframework.boot:spring-boot-cassandra
 Spring Boot's PID file write follows symlinks at predictable default path 28 Apr
  • Fix available
  • Severity - 4.7 (Medium)
GHSA-8v8j-3hxp-93wr
  • Maven/org.springframework.boot:spring-boot
 Spring Boot's default security filter chain has no authorization rule with Actuator but without Health 28 Apr
  • Fix available
  • Severity - 9.1 (Critical)
GHSA-m4x9-hx6x-2c43
  • Maven/org.springframework.boot:spring-boot-cassandra
 Spring Boot's random value property source uses a weak PRNG unsuitable for secrets 28 Apr
  • Fix available
  • Severity - 4.8 (Medium)
GHSA-mqvw-jfmh-93qq
  • Maven/org.springframework.boot:spring-boot-cassandra
 Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification 28 Apr
  • Fix available
  • Severity - 5.0 (Medium)
GHSA-wwpq-f5c3-7hvx
  • Maven/org.springframework.boot:spring-boot
 Spring Boot accepts predictable temp directory without ownership verification 28 Apr
  • Fix available
  • Severity - 7.0 (High)
GHSA-56v8-86gj-66jp
  • Maven/org.springframework.boot:spring-boot-devtools
 Spring Boot DevTools remote secret comparison is vulnerable to timing attacks 28 Apr
  • Fix available
  • Severity - 7.5 (High)
GHSA-9vc8-qppq-wvxc
  • Maven/org.springframework.boot:spring-boot-rabbitmq
 Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker 28 Apr
  • Fix available
  • Severity - 5.0 (Medium)
GHSA-c96x-rpm4-349p
  • Maven/org.springframework.boot:spring-boot-elasticsearch
 Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server. 27 Apr
  • Fix available
  • Severity - 5.0 (Medium)
GHSA-8hfc-fq58-r658
  • Maven/org.springframework.boot:spring-boot-starter-actuator
 Spring Boot has an Authentication Bypass under Actuator Health groups paths 20 Mar
  • Fix available
  • Severity - 8.2 (High)
GHSA-mgvc-8q2h-5pgc
  • Maven/org.springframework.boot:spring-boot-starter-actuator
 Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints 20 Mar
  • Fix available
  • Severity - 8.2 (High)
GHSA-rc42-6c7j-7h5r
  • Maven/org.springframework.boot:spring-boot
 Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed 28 Apr 2025
  • Fix available
  • Severity - 7.3 (High)
GHSA-7cj3-x93g-gj76
  • Maven/org.springframework.boot:spring-boot-loader
  • Maven/org.springframework.boot:spring-boot-loader-classic
 Signature forgery in Spring Boot's Loader 23 Aug 2024
  • Fix available
  • Severity - 7.2 (High)
GHSA-jjfh-589g-3hjx
  • Maven/org.springframework.boot:spring-boot-actuator
 Spring Boot Actuator denial of service vulnerability 28 Nov 2023
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-xf96-w227-r7c4
  • Maven/org.springframework.boot:spring-boot-autoconfigure
 Spring Boot Welcome Page Denial of Service 26 May 2023
  • Fix available
  • Severity - 7.5 (High)
Load more...