Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersJervis Has Weak Random for Timing Attack Mitigation
Jervis's Salt for PBKDF2 derived from password
Jervis Has a SHA-256 Hex String Padding Bug
Jervis has Deterministic AES IV Derivation from Passphrase
Jervis Has a RSA PKCS#1 Padding Vulnerability
XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
FASTJSON Includes Functionality from Untrusted Control Sphere
Bio-Formats has an XML External Entity (XXE) vulnerability
Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write
Spinnaker vulnerable to SSRF due to improper restrictions on http from user input
MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Apache StreamPipes has Improper Privilege Management issue
Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization
Amazon S3 Encryption Client for Java has a Key Commitment Issue
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
snail-job is vulnerable to Code Injection through QLExpressEngine.doEval function
aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
Apache StreamPark: Use the user’s password as the secret key Vulnerability
Apache StreamPark has a hard-coded encryption key
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.