WaratekVRT Sign in

Medium Spring-web CVEs with no public exploit

2 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
Product spring-web✕
Overview 2 matches · 0 exploited · 0 CISA KEV · 0 public PoC
2matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 2 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 2 100.0% No public exploit 0 0.0%
split by peak 1 / month
Protected by Waratek: 2 Medium: 2 blocked by ARMR today: 2 Forecast only: 2
Jan 141 Protected by Waratek1 Medium1 blocked by ARMR today1 Forecast only1 Feb 140 Mar 140 Apr 141 Protected by Waratek1 Medium1 blocked by ARMR today1 Forecast only1
Jan 14Feb 14Mar 14Apr 14
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2014-0054 Medium 2014-04-17 Protected by Waratek Forecast only The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
CVE-2013-6429 Medium 2014-01-26 Protected by Waratek Forecast only The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.