Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersLiferay Portal and DXP does not properly check permission with import and export tasks
Liferay Portal and DXP allows users to add a note to a different virtual instance
Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field
H2O affected by a deserialization vulnerability
Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource
Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability
Liferay Contacts Center widget has insecure direct object reference
Keycloak SMTP Inject Vulnerability
jinjava has Sandbox Bypass via JavaType-Based Deserialization
Jenkins has a log message injection vulnerability
Jenkins has a missing permission check, allowing users to obtain agent names
Jenkins is missing a permission check in the authenticated users' profile menu
Liferay search widget vulnerable to Cross-site Scripting
Liferay Portal allows remote attackers to view display page templates via crafted URLs
Timing Attack Vulnerability in SCRAM Authentication
JasperReports has a Java deserialisation vulnerability
Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC
Spring Expression language property modification using Spring Cloud Gateway Server WebFlux
Spring Framework annotation detection mechanism may result in improper authorization
Spring Security annotation detection mechanism has authorization bypass
Openfire has potential identity spoofing issue via unsafe CN parsing
Liferay Stored Cross-site Scripting vulnerability
Liferay has Insecure Default Initialization of Resource issue
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.