Potential sensitive data exposure in applications using Vaadin 15

概要

参考情報

• vaadin/flow security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2020-36319 · ADVISORY
• vaadin/flow#8016 · WEB
• vaadin/flow#8051 · WEB
• vaadin/flow · PACKAGE
• vaadin.com/security/cve-2020-36319 · WEB

com.vaadin:flow-server のその他の脆弱性

• CVE-2026-2742中 5.3An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 thro…
• CVE-2023-25500中 4.3Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1…
• CVE-2023-25499中 6.5When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through…
• GHSA-fr26-qjc8-mvjx中 5.3Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
• GHSA-8vfw-v2jv-9hwc低 2.5Reflected cross-site scripting in development mode handler in Vaadin