Denial of service in DataCommunicator class in Vaadin 8

概要

参考情報

• vaadin/framework security advisory · WEB
• vaadin/framework#12415 · WEB
• vaadin.com/security/cve-2021-33609 · WEB

com.vaadin:vaadin-server のその他の脆弱性

• CVE-2025-15022中 4.8Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content …
• CVE-2025-9467中 5.3When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validatio…
• CVE-2021-33609中 4.3Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authe…
• CVE-2021-31403低 2.5Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 …
• CVE-2020-36320高 7.5Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allo…