Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 85
Reset filtersNL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
Netty: QUIC stateless reset token material exposed through header-visible connection IDs
ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing
Apache CXF has Improper Restriction of XML External Entity Reference
Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference
Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port
Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)
Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data
Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Expression Injection in OpenRemote
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
Emissary has GitHub Actions Shell Injection via Workflow Inputs
Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers
HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition
Jervis Has a JWT Algorithm Confusion Vulnerability
Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation
Absent Input Validation in BinaryHttpParser
JADX file override vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.