CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1904 – Framework: cross-site scripting flaw when using Spring MVC
https://notcve.org/view.php?id=CVE-2014-1904
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action. Vulnerabilidad de XSS en web/servlet/tags/form/FormTag.java en Spring MVC en Spring Framework 3.0.0 anterior a 3.2.8 y 4.0.0 anterior a 4.0.2 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de la URI solicitada en una acción por defecto. • http://docs.spring.io/spring/docs/3.2.8.RELEASE/changelog.txt http://rhn.redhat.com/errata/RHSA-2014-0400.html http://seclists.org/fulldisclosure/2014/Mar/101 http://secunia.com/advisories/57915 http://www.gopivotal.com/security/cve-2014-1904 http://www.securityfocus.com/archive/1/531422/100/0/threaded http://www.securityfocus.com/bid/66137 https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485 https://jira.springsource.org/browse/SPR-11426 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2013-6430 – Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters
https://notcve.org/view.php?id=CVE-2013-6430
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket. El método JavaScriptUtils.javaScriptEscape en el archivo web/util/JavaScriptUtils.java en Spring MVC en Spring Framework versiones anteriores a la versión 3.2.2 no escapa correctamente a determinados caracteres, lo que permite a atacantes remotos llevar a cabo ataques de tipo cross-site scripting (XSS) por medio de una (1) separador de línea o (2) carácter Unicode separador de párrafo o corchete angular (3) izquierdo o (4) derecho. • http://www.gopivotal.com/security/cve-2013-6430 https://github.com/spring-projects/spring-framework/commit/7a7df6637478607bef0277bf52a4e0a03e20a248 https://jira.springsource.org/browse/SPR-9983 https://access.redhat.com/security/cve/CVE-2013-6430 https://bugzilla.redhat.com/show_bug.cgi?id=1039783 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 76%CPEs: 4EXPL: 0CVE-2013-6429 – Framework: XML External Entity (XXE) injection flaw
https://notcve.org/view.php?id=CVE-2013-6429
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315. El SourceHttpMessageConverter en Spring MVC en Spring Framework antes de 3.2.5 y 4.0.0.M1 hasta 4.0.0.RC1 no desactiva resolución entidad externa, lo que permite a atacantes remotos leer archivos arbitrarios, provocar una denegación de servicio, y llevar a cabo ataques CSRF a través de un XML manipulado, también conocido como un fallo de entidades externas XML (XXE) , una vulnerabilidad diferente a CVE-2013-4152 y CVE-2013-7315. • http://rhn.redhat.com/errata/RHSA-2014-0400.html http://secunia.com/advisories/57915 http://www.gopivotal.com/security/cve-2013-6429 http://www.securityfocus.com/archive/1/530770/100/0/threaded http://www.securityfocus.com/bid/64947 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 https://jira.springsource.org/browse/SPR-11078?page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel https://access.redhat.com/security/cve/CVE-2013- • CWE-352: Cross-Site Request Forgery (CSRF) CWE-611: Improper Restriction of XML External Entity Reference •