Spring Framework — универсальный фреймворк с открытым исходным кодом для Java-платформы.

Spring Framework Denial of Service via Multipart Requests in WebFlux

Spring Framework Open Redirect in Spring MVC and WebFlux

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

Spring Framework Escalation via Session Fixation in WebFlux

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

Spring Framework Predictable Session ID in WebSocket Module

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring Framework Cross-site Scripting via JavaScriptUtils

In an untrusted JMS environment, org.springframework.jms.support.conve ...

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.