Level up your Java code and explore what Spring can do for you.

The Spring Core component used in Java applications had a weakness that could allow an attacker to execute code on the server.

If your application uses Spring Cloud Gateway Server Webflux, Spring Boot actuator, and exposes actuator endpoints without security, an attacker could.

The Spring Cloud Config Server libraries from Spring Framework, VMware, and Root are affected by a security weakness that could let an attacker execute.

The Spring Web library used in Java applications (including versions supplied by Spring Framework, VMware, Root, and Debian) has a weakness that could let.

Several Spring Boot packages that you may use in Maven have a weakness that could let an attacker cause the application to execute unwanted code.

The Spring Security Core library used in several applications can be tricked into bypassing security checks, potentially letting unauthorized users access.

Promises ‘secure artifacts’ for Spring and RabbitMQ, and other projects that matter to its Tanzu suite

If your application uses Spring's SimpleEvaluationContext to process SpEL expressions and the expression compiler is turned on, an attacker could bypass.

If your application uses Spring's WebFlux with functional endpoints and the DispatcherServlet, an attacker could bypass header checks during a CORS.

Silent patches do not truly hide vulnerabilities because attackers can still diff binaries and uncover what changed, while defenders are left without the context they need to prioritize response. The article argues that Broadcom’s private Spring Enterprise Repository may give paying customers early exploit intelligence for Spring Framework issues, creating a...

I'm working on a benchmark tool comparing multiple backend stacks to see how they compare given a fixed amount of resource (CPU/ram) and on the other side how low can they go on resources based on a predefined work load (1000 req/sec for example). And then I approximate the cost of running each stack on different cloud providers in a auto-generated report. #rust #rocket #java #kotlin #springframework #js #nodejs #bunhttps://github.com/jeantuffier/slashbench

Podcast Episode · Pro Coder Show · September 17, 2022 · 18m