CVE Vulnerability Catalog

Permission management vulnerability in the network management module. Successful exploitation may affect service integrity.

Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18 are vulnerable to Server-Side Request Forgery (SSRF) due to incorrect host parsing in UriComponentsBuilder. Applications relying on UriComponentsBuilder to parse and validate external URLs may be exposed to sending requests to internal resources.

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Applications accepting user-supplied SpEL expressions may be vulnerable to DoS if evaluation triggers unbounded cache growth. Affects Spring Framework versions 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

Spring WebFlux applications using the Kotlin Router DSL may be vulnerable to a security bypass. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Spring MVC applications accepting user-supplied values in cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript injection, leading to XSS.

Spring MVC or Spring WebFlux applications with a mapping for "/**" where the view name is not explicitly specified allow an attacker to craft a 302 redirect to an arbitrary external host via the redirect: prefix. Affects Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. The vulnerability affects Spring Framework versions 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

A WebFlux application with a compromised subdomain (e.g., via XSS) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

WebSocket session IDs in the spring-websocket module are not cryptographically unpredictable, which may be exploitable in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. This requires the HTTP client to be explicitly configured to follow redirects. Affected versions: Reactor Netty 1.0.0-1.0.51, 1.1.0-1.1.35, 1.2.0-1.2.17, and 1.3.0-1.3.5.

In Spring Retry versions 2.0.0 through 2.0.12 and 1.3.0 through 1.3.4, a DoS vulnerability exists. An attacker can send a large number of unique failing requests, exhausting the application-wide stateful retry cache. Once full, all subsequent retries and circuit breakers fail permanently.

Tmux up to version 3.6a contains a use-after-free vulnerability in the image_free function in image.c. The attack requires local access and is difficult to exploit. An exploit has been publicly disclosed. The issue is fixed in version 3.7-rc.

The Product Filter Widget for Elementor plugin for WordPress up to version 1.0.6 is vulnerable to Reflected Cross-Site Scripting via the 'args[filterFormArray]' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts. Exploitation requires tricking a victim into clicking a link or CSRF-style form auto-submission to admin-ajax.php.

The jQuery Hover Footnotes plugin for WordPress up to version 1.4 is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier syntax. Authenticated attackers with author-level access can inject scripts that execute when users view the page.

The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.4. Missing nonce validation on the jqFootnotes_options_subpanel function allows unauthenticated attackers to change plugin settings. Because option values like jqfoot_anchor_open are echoed unescaped, CSRF can be chained into persistent XSS affecting all visitors.

The TinyMCE shortcode Addon plugin for WordPress up to version 1.0.0 is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Enable Media Replace plugin for WordPress up to version 4.1.8 is vulnerable to Stored XSS via the 'location_dir' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or higher can inject arbitrary scripts.