CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 24/06/2021 |
| CVE-2021-31412 | 中危5.3 | Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows networ | 24/06/2021 |
| CVE-2021-31411 | 高危7.8 | Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend reso | 05/05/2021 |
| CVE-2021-31408 | 高危7.1 | Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to | 23/04/2021 |
| CVE-2021-31405 | 高危7.5 | Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. | 23/04/2021 |
| CVE-2021-31403 | 低危2.5 | Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack | 23/04/2021 |
| CVE-2020-36320 | 高危7.5 | Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. | 23/04/2021 |
| CVE-2019-25028 | 中危6.1 | Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector | 23/04/2021 |
| GHSA-3h5r-928v-mxhh | 低危2.6 | Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 | 19/04/2021 |
| GHSA-jqj4-r483-4gvr | 中危6.1 | Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 | 19/04/2021 |
| GHSA-76f4-fw33-6j2v | 低危3.1 | Potential sensitive data exposure in applications using Vaadin 15 | 19/04/2021 |
| GHSA-82mf-mmh7-hxp5 | 中危5.9 | Directory traversal in development mode handler in Vaadin 14 and 15-17 | 19/04/2021 |
| GHSA-c6c4-7x48-4cqp | 中危4.0 | Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 | 19/04/2021 |
| GHSA-9h6g-6mxg-vvp4 | 中危4.0 | Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 | 19/04/2021 |
| GHSA-j9wr-49vq-rm5g | 高危8.6 | Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 | 19/04/2021 |