Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersmchange-commons-java: Remote Code Execution via JNDI Reference Resolution
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
Apache Camel Deserializes Untrusted Data in its LevelDB Component
carbon-apimgt does not properly restrict uploaded files
Keycloak: Missing Check on Disabled Client for Docker Registry Protocol
mingSoft MCMS does not properly restrict file uploads
Jenkins has a build information disclosure vulnerability through Run Parameter
Jenkins has a stored XSS vulnerability in node offline cause description
Apache Tomcat - Security constraint bypass with HTTP/0.9
Apache Tomcat - Client certificate verification bypass
Apache Tomcat has an Improper Input Validation vulnerability
Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates
Wildfly Elytron integration susceptible to brute force attacks via CLI
Apache Avro Java SDK is Vulnerable to Code Injection
XWiki vulnerable to click-jacking through CSS injection in comments
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability
Keycloak logs sensitive headers
Apache Druid Vulnerable to Authentication Bypass
Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService
Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
Keycloak affected by improper invitation token validation
Apache Shiro has an Authentication Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.