Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersXWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right
The lesscss script service allows cache clearing without programming right
Solr script service doesn't take dropped programming right into account
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
Apache Tomcat Denial of Service via invalid HTTP priority header
Apache Tomcat Rewrite rule bypass
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
Apereo CAS has inefficient regular expression complexity
Apereo CAS has inefficient regular expression complexity
Apereo CAS code injection vulnerability
Apache HttpClient disables domain checks
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API
XSS in the /download Endpoint of the JPA Web API
XSS in the /files Endpoint of the Generic REST API
Cuba has a DoS in the File Storage
io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage
io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API
io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage
MCMS allows arbitrary file uploads in the ueditor component
OpenCMS Cross-Site Scripting vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.