Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 85
Reset filtersXWiki Platform: Remote code execution through space title and Solr space facet
org.postgresql:postgresql vulnerable to SQL Injection via line comment generation
Apache Solr Schema Designer blindly "trusts" all configsets
Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin
DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998
HTTP/2 HPACK integer overflow and buffer allocation
Apache Tomcat Incomplete Cleanup vulnerability
Presto JDBC Server-Side Request Forgery by nextUri
Presto JDBC Server-Side Request Forgery by redirect
Jetty's OpenId Revoked authentication allows one request
Arbitrary File Creation in AbstractUnArchiver
Jenkins External Monitor Job Type Plugin XML external entity vulnerability
snappy-java's unchecked chunk length leads to DoS
XML External Entity (XXE) vulnerability in apoc.import.graphml
XML External Entity (XXE) vulnerability in apoc.import.graphml
hutool-json stack overflow vulnerability
Plaintext storage of password after a reset in org.xwiki.platform:xwiki-platform-security-authentication-default
Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions
Undertow vulnerable to Dos via Large AJP request
External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint
Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library
Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents
Sandbox bypass vulnerability in Jenkins Script Security Plugin
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.