Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersXWiki makes title of inaccessible pages available through the class property values REST API
XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right
XWiki allows remote code execution through default value of wiki macro wiki-type parameters
XWiki's required right warnings for macros are incomplete
XWiki allows privilege escalation through link refactoring
Solon Vulnerable to Directory Traversal
Spring Framework vulnerable to a reflected file download (RFD)
XWiki allows SQL injection in query endpoint of REST API with Oracle
pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx
GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
GeoServer Infinite Loop Vulnerability in Jiffle process
GeoServer Missing Authorization on REST API Index
Coverage REST API Server Side Request Forgery
GWC Home Page communicate version and revision information
GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability
Apache Kafka Deserialization of Untrusted Data vulnerability
Apache Kafka Deserialization of Untrusted Data vulnerability
GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.