Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filtersApache Kylin Files or Directories Accessible to External Parties
Liferay Portal and DXP vulnerable to a memory leak
Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands
WSO2 Identity Server Apps allows content spoofing in logs
Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability
Keycloak SMTP Inject Vulnerability
Timing Attack Vulnerability in SCRAM Authentication
Spring Expression language property modification using Spring Cloud Gateway Server WebFlux
Openfire has potential identity spoofing issue via unsafe CN parsing
Liferay Portal has External Control of System or Configuration Settings
Apache DolphinScheduler vulnerable to Alert Script Attack
Liferay Portal exposes 500 status when attempting login with a deleted client secret
Liferay Portal is vulnerable to SSRF through custom object attachment fields
FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side
Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions
Vaadin Platform possible file bypass via upload validation on the server-side
Vaadin Flow Components possible file bypass via upload validation on the server-side
Vaadin Framework possible file bypass via upload validation on the server-side
Netty's decoders vulnerable to DoS via zip bomb style attack
Undertow MadeYouReset HTTP/2 DDoS Vulnerability
XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
Liferay Portal Username Enumeration Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.