Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,120
Reset filtersBouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
Umbraco Workflow's Backoffice users can execute arbitrary SQL
.NET Elevation of Privilege Vulnerability
Blind SSRF Leads to Port Scan by using Webhooks
MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service
SixLabors.ImageSharp vulnerable to data leakage
SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size Value
Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore
Azure Identity Library for .NET Information Disclosure Vulnerability
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
WiX based installers are vulnerable to binary hijack when run as SYSTEM
Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
Umbraco possible user enumeration
CoreWCF NetFraming based services can leave connections open when they should be closed
Remote Denial of Service Vulnerability in Microsoft QUIC
Microsoft Security Advisory CVE-2024-21392: .NET Denial of Service Vulnerability
Use After Free in SixLabors.ImageSharp
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.