Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersImproper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
Improper restriction of the scope of accessible objects in Thymeleaf expressions
OpenRemote has XXE in Velbus Asset Import
Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache
Data Sharing Framework is Missing Session Timeout for OIDC Sessions
Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules
Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
XWiki's REST APIs can list all pages/spaces, leading to unavailability
XWiki has Reflected Cross-Site Scripting (XSS) in page history compare
Expression Injection in OpenRemote
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata
Apache Storm: Deserialization of Untrusted Data vulnerability
Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression
Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.