Spring Framework — универсальный фреймворк с открытым исходным кодом для Java-платформы.

A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape ...

Spring WebFlux applications may be vulnerable to a security bypass whe ...

A WebFlux application with a compromised subdomain (for example, compr ...

Applications which accept user-supplied Spring Expression Language (Sp ...

Spring MVC and WebFlux applications are vulnerable to Multipart reques ...

Applications may be vulnerable to a Regular Expression Denial of Servi ...

A vulnerability in Spring Expression Language (SpEL) evaluation logic ...

A Spring MVC or Spring WebFlux application which configures a mapping ...