Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,074
Reset filtersLog Injection in Apache Sling Commons Log and Apache Sling API
Denial of Service in Spring Cloud Function
Insufficiently Protected Credentials via Insecure Temporary File in org.apache.nifi:nifi-single-user-utils
Rundeck's Key Storage converter plugin mechanism's encryption layer not working in 4.2.0, 4.2.1, 4.3.0
Signature forgery in Biscuit
XML External Entity Reference in drools
Insufficiently Protected Credentials in PowerJob
Code injection in Apache NiFi and NiFi Registry
User account escalation in Apache Hadoop
Remote Code Execution in Apache Flume
Regular expression denial of service in Delight Nashorn Sandbox
Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2
Unsafe deserialization in com.alibaba:fastjson
Server-side request forgery in Apache Dubbo
Improper Check for Unusual or Exceptional Conditions in Elasticsearch
Server-Side Request Forgery in Jodd HTTP
Cross site scripting in XXL-job
Dev error stack trace leaking into prod in Play Framework
Denial of service binding form from JSON in Play Framework
Code injection in MCMS
Cross site scripting in Jfinal
Cross Site Request Forgery in Mingsoft MCMS
Cross-site Scripting in Filter Stream Converter Application in XWiki Platform
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.