Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 65
Reset filtersNu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
Mustangproject allows exfiltrating files via XXE attacks
CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
XWiki allows SQL injection in query endpoint of REST API with Oracle
Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language
hibernate-validator Cross-site Scripting vulnerability
Eclipse Jetty URI parsing of invalid authority
Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack
WildFly Elytron: SSRF security issue
Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year
io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud
DDFFileParser is vulnerable to XXE Attacks
XML External Entity Reference in drools
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
Apache Struts vulnerable to possible DoS attack when using URLValidator
Improper Input Validation in Apache Struts
Apache Struts vulnerable to possible DoS attack when using URLValidator
Jenkins TraceTronic ECU-TEST Plugin Man in the middle vulnerability
Jenkins CollabNet Plugin man in the middle vulnerability
Improper Authentication in Hibernate Validator
Improper Input Validation in Apache Struts
Path traversal in the OWASP Enterprise Security API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.