Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 191
Reset filtersApache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers
Netty's decoders vulnerable to DoS via zip bomb style attack
Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function
Jenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution
OpenDJ Denial of Service (DoS) using alias loop
Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know.
Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin
Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin
Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes.
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration.
Exposure of secrets through system log in Jenkins Structs Plugin
Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies
Jenkins Script Security Plugin sandbox bypass vulnerability
Elasticsearch Uncontrolled Resource Consumption vulnerability
Improper Input Validation vulnerability in Apache Hop Engine
Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin
Elasticsearch Improper Handling of Exceptional Conditions
Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin
Jeecg-boot SQL Injection vulnerability
Jenkins NodeJS Plugin improper credential masking vulnerability
Code injection in stanford-parser
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.