Spring4Shell
- Risk:
High
- Type:
- Active
- CWE:
- CWE-78
- Summary
The application appears to be vulnerable to CVE-2022-22965 (otherwise known as Spring4Shell) - remote code execution (RCE) via data binding.
- Solution
Upgrade Spring Framework to versions 5.3.18, 5.2.20, or newer.
- References
https://nvd.nist.gov/vuln/detail/CVE-2022-22965
https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#vulnerability
DNS0.EU private DNS service shuts down over sustainability issues
Microsoft: October updates break USB input in Windows Recovery
Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets
Retail giant Muji halts online sales after ransomware attack on supplier
Over 75,000 WatchGuard security devices vulnerable to critical RCE
CISA: High-severity Windows SMB flaw now exploited in attacks
Hard-coded credentials found in Moxa industrial security appliances, routers (CVE-2025-6950)
Self-spreading GlassWorm malware hits OpenVSX, VS Code registries
Microsoft warns of Windows smart card auth issues after October updates
CVE-2025-59230 Microsoft Windows Improper Access Control Vulnerability
CVE-2022-48503 Apple Multiple Products Unspecified Vulnerability
CVE-2025-6264 Rapid7 Velociraptor Incorrect Default Permissions Vulnerability
CVE-2016-7836 SKYSEA Client View Improper Authentication Vulnerability
CVE-2017-3881 Cisco IOS and IOS XE Remote Code Execution Vulnerability
CVE-2021-43226 Microsoft Windows Privilege Escalation Vulnerability
CVE-2024-8068 Citrix Session Recording Improper Privilege Management Vulnerability
CVE-2025-47827 IGEL OS Use of a Key Past its Expiration Date Vulnerability
MediumDirectory Browsing
InformationalCookie Slack Detector
MediumBuffer Overflow
Free online web security scanner