Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 546
Reset filtersFHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
Undertow is Vulnerable to HTTP Request/Response Smuggling
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
Spring Boot has an Authentication Bypass under Actuator Health groups paths
Jenkins has a link following vulnerability allows arbitrary file creation
Apache Spark: Spark History Server Code Execution Vulnerability
Keycloak SAML Broken has Authentication Bypass by Primary Weakness
Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions
Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix
Keycloak affected by improper invitation token validation
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
Keycloak Admin REST API exposes backend schema and rules
XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write
Spinnaker vulnerable to SSRF due to improper restrictions on http from user input
Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations
PowerJob has a server-side request forgery vulnerability in PingPongUtils.java
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.