Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 278
Reset filtersjte's HTML templates containing Javascript template strings are subject to XSS
http4k has a potential XXE (XML External Entity Injection) vulnerability
Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)
OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
Eclipse Jetty URI parsing of invalid authority
pac4j-core affected by a Java deserialization vulnerability
org.xwiki.platform:xwiki-platform-notifications-ui leaks data of notification filters of users
Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit
Silverpeas vulnerable to password complexity rule bypass
Jenkins Remoting library arbitrary file read vulnerability
Silverpeas Core Cross-site Scripting vulnerability
Silverpeas authentication bypass
Silverpeas Core vulnerable to Cross Site Scripting
OpenMetadata vulnerable to a SpEL Injection in `PUT /api/v1/events/subscriptions` (`GHSL-2023-251`)
OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)
Code injection in Apache Zeppelin Shell
XWiki Platform remote code execution from account through UIExtension parameters
Apache Zeppelin vulnerable to cross-site scripting in the helium module
Improper escaping in Apache Zeppelin
Stored Cross-Site Scripting (XSS) vulnerability in GeoServer's REST Resources API
SMTP smuggling in Apache James
Vulnerability affecting the org.openjfx:javafx-media maven component of the OpenJFX project
Hazelcast Platform permission checking in CSV File Source connector
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.