WaratekVRT Sign in
Reset
More filters (3)
Columns
Published to 2017-04-30✕Vendor org.springframework.security✕Has a public PoC✕
Overview 2 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
2matches 1protected50.0% 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 50.0% Rule in development 0 0.0% Mitigation candidate 1 50.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 2 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 50.0% partly blocked 0 0.0% not blocked 1 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 50.0% Proof of concept only 1 50.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / month
Mitigation candidate: 1Protected by Waratek: 1 Medium: 2 not blocked: 1blocked by ARMR today: 1 Proof of concept only: 1Working exploit published: 1
Oct 111 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1 Nov 110 Dec 110 Jan 120 Feb 120 Mar 120 Apr 120 May 120 Jun 120 Jul 120 Aug 120 Sep 120 Oct 120 Nov 120 Dec 121 Mitigation candidate1 Medium1 not blocked1 Working exploit published1
Oct 11Dec 11Feb 12Apr 12Jun 12Aug 12Oct 12Dec 12
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2011-2732 Medium 2012-12-05 Mitigation candidate Working exploit published CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
CVE-2011-2894 Medium 2011-10-04 Protected by Waratek Proof of concept only Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.