Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 310
Reset filtersApache ActiveMQ is Vulnerable to Integer Overflow or Wraparound
PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition
Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix
carbon-apimgt does not properly restrict uploaded files
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
Keycloak affected by improper invitation token validation
FASTJSON Includes Functionality from Untrusted Control Sphere
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page
Liferay Portal Vulnerable to Cross-Site Scripting
Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page
MCMS reflected cross-site scripting (XSS) vulnerability
Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
Liferay Mentions Web is Vulnerable to Cross-site Scripting
Liferay Portal's Membership page is vulnerable to XSS through “name“ text field
Liferay Portal Commerce is vulnerable to XSS through account "name" field
Liferay Portal is vulnerable to XSS through its Calendar Events parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.