CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 24/06/2021 |
| CVE-2021-31412 | 보통5.3 | Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows networ | 24/06/2021 |
| CVE-2021-31411 | 높음7.8 | Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend reso | 05/05/2021 |
| CVE-2021-31408 | 높음7.1 | Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to | 23/04/2021 |
| CVE-2021-31405 | 높음7.5 | Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. | 23/04/2021 |
| CVE-2021-31403 | 낮음2.5 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack | 23/04/2021 |
| CVE-2020-36320 | 높음7.5 | Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. | 23/04/2021 |
| CVE-2019-25028 | 보통6.1 | Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector | 23/04/2021 |
| GHSA-3h5r-928v-mxhh | 낮음2.6 | Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 | 19/04/2021 |
| GHSA-jqj4-r483-4gvr | 보통6.1 | Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 | 19/04/2021 |
| GHSA-76f4-fw33-6j2v | 낮음3.1 | Potential sensitive data exposure in applications using Vaadin 15 | 19/04/2021 |
| GHSA-82mf-mmh7-hxp5 | 보통5.9 | Directory traversal in development mode handler in Vaadin 14 and 15-17 | 19/04/2021 |
| GHSA-c6c4-7x48-4cqp | 보통4.0 | Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 | 19/04/2021 |
| GHSA-9h6g-6mxg-vvp4 | 보통4.0 | Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 | 19/04/2021 |
| GHSA-j9wr-49vq-rm5g | 높음8.6 | Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 | 19/04/2021 |