Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,602
Reset filtersJenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form
Jenkins QMetry Test Management Plugin vulnerability exposes API keys
Jenkins Dead Man's Snitch Plugin vulnerability does not mask tokens
Jenkins QMetry Test Management Plugin stores unencrypted API keys
Jenkins ReadyAPI Functional Testing Plugin vulnerability exposes secrets
Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens
Jenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key
Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint
junit-platform-reporting can leak Git credentials through its OpenTestReportGeneratingListener
Graylog vulnerable to privilege escalation through API tokens
Janssen Config API returns results without scope verification
Xuxueli XXL-SSO Cross-site Scripting vulnerability
XXL SSO is vulnerable to an Open Redirect through malicious manipulation of the redirect_url argument
Allure Report allows Improper XXE Restriction via DocumentBuilderFactory
sentry-android unmasked sensitive data in Android Session Replays for users of Jetpack Compose 1.8+
PowSyBl Core contains Polynomial REDoS’es
Apache SeaTunnel: Unauthenticated insecure access
Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler
XWiki makes title of inaccessible pages available through the class property values REST API
GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
GeoServer Infinite Loop Vulnerability in Jiffle process
GeoServer Missing Authorization on REST API Index
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.