Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Liferay Portal and Liferay DXP insecure default configuration
Liferay Portal and Liferay DXP does not properly check user permission
Liferay Portal and Liferay DXP autosaves form data for other users to see
Liferay Portal and Liferay DXP Don't Check Permissions of Pages
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary Page
Liferay Portal and Liferay DXP Stores User Passwords in Cleartext
Liferay Portal and Liferay DXP Fails to Check User Permissions for Workflow Submissions
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)
Liferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLs
Liferay Portal and Liferay DXP Fails to Properly Check User Permissions
NukeViet Cross-site Scripting via the editor in the News module
NukeViet SQL Injection vulnerability
NukeViet SQL Injection vulnerability via topicsid parameter
Improper Privilege Management in Neo4j Graph Database
Generation of Error Message Containing Sensitive Information in Elasticsearch
ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability
Xen Orchestra Mishandles Authorization
LavaLite Stored Cross-site Scripting vulnerability
Stored XSS in LavaLite 5.8.0
Stored XSS in LavaLite 5.8.0
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.
Missing permission check in Jenkins requests-plugin Plugin allows viewing pending requests
Improper permission checks allow canceling queue items and aborting builds in Jenkins
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.