Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersApache Tomcat - Denial of Service
Remote Code Execution (RCE) vulnerability in geoserver
Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat
GeoServer's Server Status shows sensitive environmental variables and Java properties
Exposure of secrets through system log in Jenkins Structs Plugin
Secret file credentials stored unencrypted in rare cases by Plain Credentials Plugin
DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document
Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java
XWiki programming rights may be inherited by inclusion
Cross site scripting in Apache JSPWiki
Keycloak leaks configured LDAP bind credentials through the Keycloak admin console
Undertow's url-encoded request path information can be broken on ajp-listener
DeepJavaLibrary API absolute path traversal
CrateDB has a Client initialized Session-Renegotiation DoS
Elasticsearch StackOverflow vulnerability
Keycloak Denial of Service via account lockout
Keycloak's improper input validation allows using email as username
Apache Submarine Server Core has a SQL Injection Vulnerability
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core.
** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils.
Keycloak's admin API allows low privilege users to use administrative functions
Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
BoringSSLAEADContext in Netty Repeats Nonces
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.