8 matches found
CVE-2019-25027
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL...
CVE-2019-25027
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL...
com.github.mcollovati.vertx:vaadin-flow-sockjs (12.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (12.0.0) +149 more potentially affected by CVE-2019-25027 via com.vaadin:flow-server (>=1.1.0, <=1.4.2)
com.vaadin:flow-server MAVEN version =1.1.0, =0.5.2, =1.0.0, =1.0.0, =1.0.0, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.5 and more Source cves: CVE-2019-25027 Source advisory: MEND:CVE-2019-25027...
CVE-2019-25027 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL...
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL. -...
com.github.mcollovati.vertx:vaadin-flow-sockjs (12.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (12.0.0) +149 more potentially affected by CVE-2019-25027 via com.vaadin:flow-server (>=1.1.0, <=1.4.2)
com.vaadin:flow-server MAVEN version =1.1.0, =0.5.2, =1.0.0, =1.0.0, =1.0.0, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.5 and more Source cves: CVE-2019-25027 Source advisory: OSV:GHSA-RP4X-WXQV-CF9M...
com.github.mcollovati.vertx:vaadin-flow-sockjs (12.0.0), com.github.mcollovati.vertx:vertx-vaadin-flow (12.0.0) +149 more potentially affected by CVE-2019-25027 via com.vaadin:flow-server (>=1.1.0, <=1.4.2)
com.vaadin:flow-server MAVEN version =1.1.0, =0.5.2, =1.0.0, =1.0.0, =1.0.0, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.0-rc1, =5.2.5 and more Source cves: CVE-2019-25027 Source advisory: GHSA-RP4X-WXQV-CF9M...
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL. -...