Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,601
Reset filtersApache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel
Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
Improper restriction of the scope of accessible objects in Thymeleaf expressions
OpenRemote has XXE in Velbus Asset Import
Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache
Data Sharing Framework is Missing Session Timeout for OIDC Sessions
Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Expression Injection in OpenRemote
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
Apache Tomcat: Configured cipher preference order not preserved
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection
PowerJob vulnerable to SQL injection
Emissary has Stored XSS via Navigation Template Link Injection
Java-SDK has a DNS Rebinding Vulnerability
OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.