com.faendir.vaadin:jfreechart-flow (1.1.6), com.github.mcollovati.vertx:vaadin-flow-sockjs (0.2.0) +93 more potentially affected by CVE-2021-31404 via com.vaadin:flow-server (>=1.0.0, <=1.0.13)

com.vaadin:flow-server MAVEN version =1.0.0, =0.2.0, =0.5.0, =1.0.0, =1.0.0.alpha1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.13 and more Source cves: CVE-2021-31404 Source advisory: MEND:CVE-2021-31404...

com.beirtipol:jfixtools-reporting (1.0-beta), com.beirtipol:jfixtools-ui-vaadin (1.0-beta) +107 more potentially affected by CVE-2021-31404 via com.vaadin:flow-server (>=3.0.0, <=5.0.2)

com.vaadin:flow-server MAVEN version =3.0.0, =1.1.6, =15.0.0, =15.0.0, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.0.0, =5.0.2 and more Source cves: CVE-2021-31404 Source advisory: MEND:CVE-2021-31404...

CVE-2021-31407

Vulnerability: CVE-2021-31407 affects Vaadin’s OSGi integration in flow-server. Affected: com.vaadin:flow-server versions 1.2.0–2.4.7 (Vaadin 12.0.0–14.4.9) and 6.0.0–6.0.1 (Vaadin 19.0.0). Description: allows an attacker to access server-side application classes and resources via a crafted HTTP ...

com.beirtipol:jfixtools-reporting (1.0-beta), com.beirtipol:jfixtools-ui-vaadin (1.0-beta) +107 more potentially affected by CVE-2021-31406 via com.vaadin:flow-server (>=3.0.0, <=5.0.3)

com.vaadin:flow-server MAVEN version =3.0.0, =1.1.6, =15.0.0, =15.0.0, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.0.0, =5.0.3 and more Source cves: CVE-2021-31406 Source advisory: MEND:CVE-2021-31406...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0), com.dorkbox.gradlevaadin:com.dorkbox.gradlevaadin.gradle.plugin (>=0.1, <=14.1.4) +259 more potentially affected by CVE-2021-31407 via com.vaadin:flow-server (>=1.2.0, <=2.4.7)

com.vaadin:flow-server MAVEN version =1.2.0, =1.0.0.m1, =0.1, =1.0, =0.0.1, =12.0.0, =12.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =0.0.3, =0.5.1, =0.5.2, =1.1.4, =1.1.6 and more Source cves: CVE-2021-31407 Source advisory: MEND:CVE-2021-31407...

com.faendir.vaadin:jfreechart-flow (1.1.6), com.github.mcollovati.vertx:vaadin-flow-sockjs (0.2.0) +89 more potentially affected by CVE-2018-25007 via com.vaadin:flow-server (>=1.0.0, <=1.0.5)

com.vaadin:flow-server MAVEN version =1.0.0, =0.2.0, =0.5.0, =1.0.0.alpha1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.5 and more Source cves: CVE-2018-25007 Source advisory: MEND:CVE-2018-25007...

com.faendir.vaadin:jfreechart-flow (1.1.6), com.github.mcollovati.vertx:vaadin-flow-sockjs (0.2.0) +93 more potentially affected by CVE-2019-25027 via com.vaadin:flow-server (>=1.0.0, <=1.0.10)

com.vaadin:flow-server MAVEN version =1.0.0, =0.2.0, =0.5.0, =1.0.0, =1.0.0.alpha1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.10 and more Source cves: CVE-2019-25027 Source advisory: MEND:CVE-2019-25027...

com.github.mcollovati.vertx:vaadin-flow-sockjs (12.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (12.0.0) +149 more potentially affected by CVE-2019-25027 via com.vaadin:flow-server (>=1.1.0, <=1.4.2)

com.vaadin:flow-server MAVEN version =1.1.0, =0.5.2, =1.0.0, =1.0.0, =1.0.0, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.5 and more Source cves: CVE-2019-25027 Source advisory: MEND:CVE-2019-25027...

CVE-2019-25027 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL...

CVE-2019-25027

The CVE-2019-25027 issue affects com.vaadin:flow-server, specifically the default RouteNotFoundError view. The vulnerability arises from missing output sanitization and affects versions 1.0.0–1.0.10 (Vaadin 10.0.0–10.0.13) and 1.1.0–1.4.2 (Vaadin 11.0.0–13.0.5), allowing an attacker to execute ma...

CVE-2020-36321

CVE-2020-36321 affects the Vaadin flow-server: vulnerable versions are 2.0.0–2.4.1 (Vaadin 14.0.0–14.4.2) and 3.0 prior to 5.0 (Vaadin 15 prior to 18). The flaw is improper URL validation in the development mode handler, enabling an attacker to request arbitrary files outside the intended fronten...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.0.m1, <=1.0.0.rc3), com.dorkbox.gradlevaadin:com.dorkbox.gradlevaadin.gradle.plugin (0.1) +230 more potentially affected by CVE-2020-36321 via com.vaadin:flow-server (>=2.0.0, <=2.4.1)

com.vaadin:flow-server MAVEN version =2.0.0, =1.0.0.m1, =1.0, =0.0.1, =14.0.0, =14.0.0, =1.0.0, =0.3.1, =1.0.0, =1.0.0, =0.0.3, =0.5.1, =2.0.1, =2.0.1, =2.2.3 and more Source cves: CVE-2020-36321 Source advisory: MEND:CVE-2020-36321...

Insecure Session Management

flow-server uses an insecure session management. The server session is not invalidated when the logout helper method of Authentication module is used via a HTTP GET request...

Vaadin Flow code issues and vulnerabilities

Vaadin flow is a software application.The Vaadin platform is a Java framework for building modern websites that look great, perform well and keep you and your users happy. A code issue vulnerability exists in vaadin:flow-server versions 1.0.0 through 1.0.5 that stems from a missing check in the...

flow-server security vulnerabilities

Vaadin flow is an application. the Java framework for the Vaadin platform for building modern websites that look great, perform well and keep you and your users happy. A security vulnerability exists in flow-server versions 1.2.0 through 2.4.7 that allows an attacker to gain access to the...

Vaadin Flow information leakage vulnerability

Vaadin flow is a software application. the Vaadin platform is a Java framework for building modern websites that look great, perform well and keep you and your users happy. An information disclosure vulnerability exists in vaadin:flow-server, which stems from an insecure configuration of the...

Vaadin Flow path traversal vulnerability

Vaadin flow is a software application. the Vaadin platform is a Java framework for building modern websites that look great, perform well and keep you and your users happy. A path traversal vulnerability exists in vaadin: flow-server versions 2.0.0 through 2.4.1, which can be exploited by an...

CVE-2021-31406: Observable Timing Discrepancy

Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 Vaadin 15.0.0 through 18.0.6, and com.vaadin:fusion-endpoint version 6.0.0 Vaadin 19.0.0 allows attacker to guess a security token for Fusion endpoints via timing attack...

Remote Code Execution (RCE)

flow-server is vulnerable to remote code execution. An attacker is able to exploit the vulnerability by sending a fake synchronization message to the server, updating server-side element property values...

Information Disclosure

flow-server is vulnerable to information disclosure. Insecure configuration of the default ObjectMapper discloses confidential data if the application also uses e.g. @RestController...