Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filtersio.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage
Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value
The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server
Jenkins AsakusaSatellite Plugin Does not Mask API Keys via Job Configuration Form
Jenkins AsakusaSatellite Plugin Stores API Keys Unencrypted in Job `config.xml` Files
Apache Pinot Vulnerable to Authentication Bypass
Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type
Netty QUIC hash collision DoS attack
Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint
Apache Druid vulnerable to Server-Side Request Forgery, Cross-site Scripting, Open Redirect
H2O Vulnerable to Arbitrary File Overwrite
H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request
H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing
H2O Vulnerable to Arbitrary File Overwrite via File Export
H2O Vulnerable to Execution of Arbitrary Files
H2O Vulnerable to Denial of Service (DoS) and File Write
H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint
XWiki allows unregistered users to access private pages information through REST endpoint
Jenkins Zoho QEngine Plugin Displays Unmasked API Keys
Snowflake JDBC Driver client-side encryption key in DEBUG logs
LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection
LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API
LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.