WaratekVRT Sign in
Reset
More filters (3)
Columns
Protection: Full✕Published from 2017-04-01✕Vendor org.springframework.data✕
Overview 4 matches · 2 exploited · 1 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
4matches 2exploited50.0% 1CISA KEV25.0% 2public PoC50.0% 2EPSS ≥ 0.550.0%
Protected by Waratek 4 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 50.0% High 1 25.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 50.0%
split by peak 1 / month
Protected by Waratek: 4 Medium: 1High: 1Critical: 2 blocked by ARMR today: 4 No public exploit: 2Exploited: 2
Jan 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Feb 180 Mar 180 Apr 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 May 181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Jun 180 Jul 180 Aug 180 Sep 180 Oct 180 Nov 180 Dec 180 Jan 190 Feb 190 Mar 190 Apr 190 May 191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
Jan 18Mar 18May 18Jul 18Sep 18Nov 18Jan 19Mar 19May 19
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-3797 Medium 2019-05-06 Protected by Waratek No public exploit This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
CVE-2018-1259 High 2018-05-11 Protected by Waratek No public exploit Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
CVE-2018-1273 Critical 2018-04-11 Protected by Waratek Exploited Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVE-2017-8046 Critical 2018-01-04 Protected by Waratek Exploited Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.