Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filterssnail-job is vulnerable to Code Injection through QLExpressEngine.doEval function
aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations
Apache StreamPark: Use the user’s password as the secret key Vulnerability
Apache StreamPark uses a Weak Encryption Algorithm
Apache StreamPark has a hard-coded encryption key
Apache HugeGraph-Server: RAFT and deserialization vulnerability
PowerJob has a server-side request forgery vulnerability in PingPongUtils.java
Race condition in the Okta Java SDK
Improper Memory Cleanup in the Okta Java SDK
Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability
Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability
Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
Jenkins is missing a permission check on password fields
Jenkins's build authorization token is stored and displayed in plain text
Jenkins's build authorization token is stored and displayed in plain text
Jenkins has a Denial of service vulnerability in HTTP-based CLI
Jenkins has a CSRF vulnerability on the login form
Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Apache Struts has a Denial of Service vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.