Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,074
Reset filtersApache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability
HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4
Quarkus CXF logs passwords and other secrets
JSON-lib mishandles an unbalanced comment string
Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)
Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
Jenkins exposes multi-line secrets through error messages
Jenkins item creation restriction bypass vulnerability
Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission
Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation
Jenkins OpenId Connect Authentication Plugin lacks audience claim validation
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.
Eclipse Glassfish improperly handles http parameters
Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials
Apache Hadoop: Temporary File Local Information Disclosure
Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability
Spring Framework DoS via conditional HTTP request
DataEase has an XML External Entity Reference vulnerability
DataEase's H2 datasource has a remote command execution risk
protobuf-java has potential Denial of Service issue
Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack
SOFA Hessian Remote Command Execution (RCE) Vulnerability
org.xwiki.platform:xwiki-platform-notifications-ui leaks data of notification filters of users
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.