Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filtersGWC Home Page communicate version and revision information
GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability
Apache Kafka Deserialization of Untrusted Data vulnerability
GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation
Para Inserts Sensitive Information into Log File for Facebook authentication
Jenkins Gatling Plugin Vulnerable to Cross-Site Scripting (XSS)
Para Server Logs Sensitive Information
WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Fess has Insecure Temporary File Permissions
Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting
Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit
**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request
Graylog Allows Session Takeover via Insufficient HTML Sanitization
Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser
WSO2 API Manager XML External Entity (XXE) vulnerability
XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
Apereo CAS has inefficient regular expression complexity
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
Cuba has a DoS in the File Storage
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.