Spring by VMware vulnerabilities
We track 3 vulnerabilities in Spring by VMware products across 2 products. 3 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 4, 2022.
Latest Spring by VMware vulnerabilities
- 9.8 Critical severity
Spring by VMware: Improper Control of Generation of Code
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing supp
- 9.8 Critical severity
Spring by VMware: Authorization Bypass Through User-Controlled Key
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expec
- 7.5 High severity
VMware Tanzu Spring Cloud Config Directory Traversal Exploited
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a