Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,074
Reset filtersOpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand
OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
OpenRefine has a reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)
Apache Syncope: Stored XSS in Console and Enduser
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Spring Framework DataBinder Case Sensitive Match Exception
JetBrains Ktor information disclosure
Insecure Default Initialization of Resource vulnerability in Apache Solr
Improper Authentication vulnerability in Apache Solr
SAK-50571 Sakai Kernel users created with type roleview can login as a normal user
Eclipse Jetty URI parsing of invalid authority
Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks
Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
Eclipse Jetty has a denial of service vulnerability on DosFilter
pac4j-core affected by a Java deserialization vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.