CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 24/06/2021 |
| CVE-2021-31412 | MEDIUM5.3 | Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows networ | 24/06/2021 |
| CVE-2021-31411 | HIGH7.8 | Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend reso | 05/05/2021 |
| CVE-2021-31408 | HIGH7.1 | Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to | 23/04/2021 |
| CVE-2021-31405 | HIGH7.5 | Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. | 23/04/2021 |
| CVE-2021-31403 | LOW2.5 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack | 23/04/2021 |
| CVE-2020-36320 | HIGH7.5 | Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. | 23/04/2021 |
| CVE-2019-25028 | MEDIUM6.1 | Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector | 23/04/2021 |
| GHSA-3h5r-928v-mxhh | LOW2.6 | Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 | 19/04/2021 |
| GHSA-jqj4-r483-4gvr | MEDIUM6.1 | Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 | 19/04/2021 |
| GHSA-76f4-fw33-6j2v | LOW3.1 | Potential sensitive data exposure in applications using Vaadin 15 | 19/04/2021 |
| GHSA-82mf-mmh7-hxp5 | MEDIUM5.9 | Directory traversal in development mode handler in Vaadin 14 and 15-17 | 19/04/2021 |
| GHSA-c6c4-7x48-4cqp | MEDIUM4.0 | Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 | 19/04/2021 |
| GHSA-9h6g-6mxg-vvp4 | MEDIUM4.0 | Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 | 19/04/2021 |
| GHSA-j9wr-49vq-rm5g | HIGH8.6 | Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 | 19/04/2021 |