Attributed metadata history

Up to 100 retained publisher events per page for CVE-2018-11039. Withdrawals and unavailable references remain attributed to their publishers.

nvd

observed · 2026-10-12 05:28:42 UTC

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

Fingerprint: 060c830df8ef3a4ab8110329ebe275668c9062751d4bd21bd6eaa42d835dba17

nvd

available · 2026-10-12 04:02:58 UTC

available

Fingerprint: 1a480b1c570dfec82c1cc39b732387360c17935637e0981c7b0fd9c8798dc341