Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 191
Reset filtersNetty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length
Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator
Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
Netty has HttpClientCodec response desynchronization
Netty Lz4FrameDecoder is vulnerable to resource exhaustion
Netty HTTP/3 QPACK literal unbounded allocation
Camel-PQC Vulnerable to Deserialization of Untrusted Data
Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
Spinnaker: RCE via expression parsing due to unrestricted context handling
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
Spinnaker vulnerable to SSRF due to improper restrictions on http from user input
MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Apache StreamPipes has Improper Privilege Management issue
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability
Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.