Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersKeycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata
Apache Storm: Deserialization of Untrusted Data vulnerability
Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Spring Cloud Gateway's SSL bundle configuration silently bypassed
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
Apache Tomcat has an Open Redirect vulnerability
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
Emissary has a Path Traversal via Blacklist Bypass in Configuration API
Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
Emissary has GitHub Actions Shell Injection via Workflow Inputs
PowerJob vulnerable to SQL injection
Emissary has Stored XSS via Navigation Template Link Injection
Java-SDK has a DNS Rebinding Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.