Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersGeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
Apache cxf-core: No restriction on attachment headers per message
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access
Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator
Spring for GraphQL: Unsafe Deserialization
Spring Web Services: X.509 authentication bypasses Spring Security account checks
Spring Web Services: WSS4J validation does not use configured replay cache
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Spring Web Services: SOAP security faults leak Spring Security account state
Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Jenkins: Missing permission check allows unauthorized cancellation of queue items
Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations
Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL
Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL
Jenkins exposes other users' timezone and view names to users with Overall/Read permission
Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.