Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Improper Input Validation in Apache Jackrabbit
Alkacon OpenCMS XSS via homelink, workplaceresource, mode and query parameters
Apache Storm remote code execution vulnerability
Improper Access Control in Elasticsearch
Silverstripe CMS Open Redirect
Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
TYPO3 cross-site scripting (XSS)
Apache James Server OS Command Injection
Symfony Session Fixation Vulnerability
CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter
Apache OpenMeetings Directory Traversal vulnerability
Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post
Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file
Apache OpenMeetings Cross-site Scripting vulnerability
Apache OpenMeetings Cross-site Scripting vulnerability
Shopware RCE Vulnerability
WSO2 Carbon vulnerable to Cross-site Scripting
WSO2 Carbon directory traversal vulnerability
Improper Access Control in Apache Shiro
Improper Input Validation in Apache Qpid AMQP 0-x JMS
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and
Improper Access Control in Apache Shiro
Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile act
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.