Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,281
Reset filtersGeoServer's Style Publisher vulnerable to Stored Cross-Site Scripting (XSS)
GeoServer Arbitrary file renaming vulnerability in REST Coverage/Data Store API
Stored Cross-Site Scripting (XSS) vulnerability in GeoServer's REST Resources API
Arbitrary file upload vulnerability in GeoServer's REST Coverage Store API
GeoServer log file path traversal vulnerability
FitNesse Cross-site Scripting vulnerability
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
In Quarkus, git credentials could be inadvertently published
Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint
Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
Jenkins Delphix Plugin has improper SSL/TLS certificate validation
Jenkins AppSpider Plugin missing permission checks
Apache Archiva Reflected Cross-site Scripting vulnerability
Apache Archiva Incorrect Authorization vulnerability
Apache Archiva Incorrect Authorization vulnerability
Apache Ambari: Various Cross site scripting problems
Apache Ambari XML External Entity injection
Apache Ambari: authenticated users could perform command injection to perform RCE
Apache James server: Privilege escalation via JMX pre-authentication deserialization
SAML authentication bypass due to missing validation on unsigned SAML messages
Armeria SAML authentication bypass due to missing validation on unsigned SAML messages
XWiki extension license information is public, exposing instance id and license holder details
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.