Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 546
Reset filtersXWiki Jetty Package (XJetty) allows accessing any application file through URL
NutzBoot vulnerable to deserialization
Jenkins Start Windocks Containers Plugin is missing a permission check
Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery
Keycloak TLS Client-Initiated Renegotiation Denial of Service
Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl
Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names
Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories
Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
PowerJob OpenAPIController is missing authorization
WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled
Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
Openfire has potential identity spoofing issue via unsafe CN parsing
Vaadin Platform possible file bypass via upload validation on the server-side
Vaadin Flow Components possible file bypass via upload validation on the server-side
Vaadin Framework possible file bypass via upload validation on the server-side
Netty's decoders vulnerable to DoS via zip bomb style attack
Opencast has a partial path traversal vulnerability in UI config
XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format
DSpace is vulnerable to XML External Entity injection during archive imports
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.