Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 547
Reset filtersGraylog user session is still usable after logout
Bouncy Castle For Java LDAP injection vulnerability
org.xwiki.commons:xwiki-commons-xml's HTML sanitizer allows form elements in restricted
XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email
XWiki Platform's Mail.MailConfig can be edited by any user with edit rights
GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language
Administration Console authentication bypass in openfire xmppserver
Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting
Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability
XWiki Platform vulnerable to RXSS via editor parameter - importinline template
Cross Site Scripting in OpenTSDB
Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
Code injection via unescaped translations in xwiki-platform
Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies
org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability
Apiman vulnerable to permissions bypass due to missing check on API key URL
Improper Input Validation In Eclipse BIRT
HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
org.xwiki.platform:xwiki-platform-panels-ui vulnerable to Eval Injection
xwiki contains Incorrect Authorization
GeoTools OGC Filter SQL Injection Vulnerabilities
GeoServer OGC Filter SQL Injection Vulnerabilities
Arbitrary code execution in de.tum.in.ase:artemis-java-test-sandbox
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.