Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersHL7 FHIR IG Publisher potentially exposes GitHub repo user and credential information
XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`
CSRF vulnerability in Jenkins Azure Service Fabric Plugin
Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin
HAL Console has a Cross Site Scripting (XSS) vulnerability of user input
Insecure Temporary File in RESTEasy
Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability
XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing
Denial of Service in Keycloak Server via Security Headers
jte's HTML templates containing Javascript template strings are subject to XSS
Apache NiFi: Missing Complete Authorization for Parameter and Service References
Amazon Redshift JDBC Driver vulnerable to SQL Injection
Apache MINA Deserialization RCE Vulnerability
Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment
Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails
Spring Framework Path Traversal vulnerability
Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm
Elasticsearch Incorrect Authorization vulnerability
Welcome and About GeoServer pages communicate version and revision information
Ucum-java has an XXE vulnerability in XML parsing
XWiki allows remote code execution through the extension sheet
XWiki Platform has an SQL injection in getdocuments.vm with sort parameter
http4k has a potential XXE (XML External Entity Injection) vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.