Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersMicrocks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download
OpenSearch StackOverflow vulnerability
RuoYi vulnerable to SQL injection vulnerability
Apache Tiles: Unvalidated input may lead to path traversal and XXE
Eclipse IDE XXE in eclipse.platform
Jenkins Google Compute Engine Plugin has incorrect permission checks
Apache Tomcat Improper Input Validation vulnerability
Apache ActiveMQ Deserialization of Untrusted Data vulnerability
Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year
Apache DolphinScheduler Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Bouncy Castle Denial of Service (DoS)
Directory Traversal in jeecg-boot
Cross-Site Request Forgery with QueryOnXWiki allows arbitrary database queries
Whole content of all documents of all wikis exposed to anybody with view right on Solr suggest service
Cookies are sent to external images in rendered diff (and server side request forgery)
Apache Derby: LDAP injection vulnerability in authenticator
Authenticated users can view job names and groups they do not have authorization to view
H2O local file inclusion vulnerability
Apache Hadoop allows local user to gain root privileges
Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain
xxl-job-admin vulnerable to Cross Site Scripting
xxl-job-admin vulnerable to Insecure Permissions
Java: DoS Vulnerability in JSON-JAVA
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.