Critical
CVE-2021-40865
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,601
Reset filters
Critical
CVE-2021-38294
Command injection leading to Remote Code Execution in Apache Storm
Medium
ghsa-fr26-qjc8-mvjx
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
High
ghsa-jfmf-w293-8xr8
Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Medium
ghsa-j23j-q57m-63v3
Denial of service in DataCommunicator class in Vaadin 8
Medium
CVE-2021-33609
Denial of service in DataCommunicator class in Vaadin 8
Medium
CVE-2021-3312
XML External Entity Reference in org.opencms:opencms-core
High
CVE-2020-7692
Improper Authorization in Google OAuth Client
Medium
CVE-2021-36749
Druid ingestion system Authenticated users can read data from other sources than intended
High
CVE-2021-41084
Response Splitting from unsanitized headers
High
CVE-2020-21122
Server-Side Request Forgery in UReport
High
CVE-2021-39239
XML External Entity Reference in Apache Jena
Critical
CVE-2021-38555
XML Injection in Any23
Critical
CVE-2021-37579
Security check skip in Apache Dubbo
High
CVE-2021-37137
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
High
CVE-2021-39177
User impersonation due to incorrect handling of the login JWT
Critical
CVE-2021-39185
Default CORS config allows any origin with credentials
Critical
CVE-2021-34371
Deserialization of Untrusted Data in Neo4j
Medium
CVE-2021-39132
YAML deserialization can run untrusted code
High
CVE-2021-39133
Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Medium
CVE-2021-32827
Injection in MockServer
High
CVE-2021-39150
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
High
CVE-2021-39152
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Medium
CVE-2020-15522
Timing based private key exposure in Bouncy Castle
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.