Skip to content

Product

org.springframework/spring-oxm vulnerabilities

2 published CVES affecting org.springframework/spring-oxm, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest org.springframework/spring-oxm CVEs

Newest publication first

  1. CVE-2013-7315 Missing XML Validation in Spring Framework

    Published
    MediumCVSS 6.8

    The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafte...

  2. CVE-2013-4152 Cross-Site Request Forgery in Spring Framework

    Published
    MediumCVSS 6.8

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external enti...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.