Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersLiferay Portal is vulnerable to XSS attack through its Style Book theme
Liferay Portal is vulnerable to SSRF through custom object attachment fields
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data
FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side
Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions
Vaadin Platform possible file bypass via upload validation on the server-side
Vaadin Flow Components possible file bypass via upload validation on the server-side
Vaadin Framework possible file bypass via upload validation on the server-side
Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin
Netty's decoders vulnerable to DoS via zip bomb style attack
XWiki configuration files can be accessed through jsx and sx endpoints
XWiki configuration files can be accessed through the webjars API
Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials
Jenkins Git client Plugin file system information disclosure vulnerability
Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated
Apache DolphinScheduler Incorrect Default Permissions Vulnerability
Undertow MadeYouReset HTTP/2 DDoS Vulnerability
Silverpeas Core Username Enumeration Vulnerability
Liferay Portal allows improper access through the expandoTableLocalService
Opencast has a partial path traversal vulnerability in UI config
Valtimo scripting engine can be used to gain access to sensitive data or resources
XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.