CVE-2018-1229

Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.

• CWE-79
• CWE-79

• http://www.securityfocus.com/bid/103462Third Party Advisory, VDB Entry
• https://pivotal.io/security/cve-2018-1229Vendor Advisory
• http://www.securityfocus.com/bid/103462Third Party Advisory, VDB Entry
• https://pivotal.io/security/cve-2018-1229Vendor Advisory

Published

Mar 21, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1227Pivotal Concourse after 2018-03-05 might allow remote attack…
• CVE-2018-12270In Valve Steam 1528829181 BETA, it is possible to perform a …
• CVE-2018-12271An issue was discovered in the com.getdropbox.Dropbox app 10…
• CVE-2018-12272xowl/request.php in Ximdex 4.0 has XSS via the content param…
• CVE-2018-12273The /edit URI in the DMS component in Ximdex 4.0 has XSS via…
• CVE-2018-1228Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-12290The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.
• CVE-2018-12291The on_get_missing_events function in handlers/federation.py…
• CVE-2018-12292A use-after-free vulnerability exists in DOMProxyHandler::En…
• CVE-2018-12293The getImageData function in the ImageBufferCairo class in W…
• CVE-2018-12294WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in W…
• CVE-2018-12295SQL injection in folderViewSpecific.psp in Seagate NAS OS ve…