Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersNeo4j Enterprise and Community vulnerable to a potential information disclosure
Apache Syncope: Console XXE on Keymaster parameters
Apache Syncope: Reflected XSS on Enduser Login
JinJava Bypass through ForTag leads to Arbitrary Java Execution
Crafter CMS has Improper Control of Dynamically-Managed Code Resources
H2O has an External Control of File Name or Path vulnerability
Keycloak Server-Side Request Forgery (SSRF) vulnerability
Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
jsonrpc4j has Infinite Loop in RPC Stream Writer
Quick-Media Batik Codec FIX package has Code Injection vulnerability
Quick-Media Batik Codec FIX Package has Buffer Overflow Vulnerability in PNG Codec
weixin4j has Improperly Controlled Sequential Memory Allocation
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion
Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods
Apache Continuum vulnerable to Command Injection through Installations REST API
Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector
Apache Hadoop HDFS Native Client has Out-of-bounds Write Vulnerability
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
Hibernate vulnerable to SQL Injection
Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide
Logback allows an attacker to instantiate classes already present on the class path
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.