CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Spring Cloud Function SpEL Injection Remote Code Execution Vulnerability (CVE-2022-22963)
[Affected Scope] Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions
[Impact] Unauthenticated remote attackers can inject malicious SpEL expressions via HTTP headers to execute arbitrary system commands and access local resources.
[Mitigation] Immediately upgrade Spring Cloud Function to version 3.1.7, 3.2.3, or higher, and block suspicious routing headers using WAF rules.
Apache Log4j 2 Remote Code Execution and Information Disclosure Vulnerability (CVE-2021-45046) Security Advisory
[Affected Scope] Apache Log4j versions 2.0-beta9 to 2.15.0 (including 2.15.0 for Java 8 and 2.12.1 or below for Java 7)
[Impact] Attackers can exploit JNDI Lookup patterns via Thread Context Map (MDC) inputs in non-default configurations to achieve remote code execution (RCE) or information leakage
[Mitigation] Immediately upgrade Apache Log4j to version 2.16.0 (for Java 8+) or 2.12.2 (for Java 7+), which disables JNDI by default and removes message lookup support