Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 437
Reset filtersGraylog vulnerable to privilege escalation through API tokens
Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler
Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session
Liferay Portal does not limit the depth of a GraphQL queries
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation
Graylog Allows Session Takeover via Insufficient HTML Sanitization
Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser
Liferay Portal Reflected XSS in marketplace-app-manager-web
Liferay Cross-site Scripting vulnerability
Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value
Liferay Portal and Liferay DXP Reveals Data via Forms
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)
Wire has Uncontrolled Recursion on Nested Groups
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
Apache Hive vulnerable to Observable Timing Discrepancy and Authentication Bypass by Spoofing
Narayana deadlock via multiple join requests sent to LRA Coordinator
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
Graylog concurrent PDF report rendering can leak other users' reports
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.