PraisonAI 信息泄露漏洞

PraisonAI is a low-code multi-agent collaboration framework developed by Mervin Praison. Versions of PraisonAI prior to 4.5.115 contained an information leakage vulnerability. This vulnerability stemmed from a lack of authentication in the event flow server, which could lead to information leaks...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to inconsistent path pattern matching of reserved framework paths. An attacker can create unauthorized sessions and trigger framework initialization by accessing the /VAADIN endpoint without a trailing slash,...

Information Disclosure

flow-server is vulnerable to information disclosure. Lack of validation and sanitization of path in the default RouteNotFoundError view allows an attacker to enumerate available routes via malicious HTTP requests...

Remote Code Execution (RCE)

flow-server is vulnerable to remote code execution. The vulnerability exists due to a the system not escaping the " character when passing request via DevModeHandlerImpl...

CVE-2021-33604

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 Vaadin 14.0.0 through 14.6.1, 3.0.0 through 6.0.9 Vaadin 15.0.0 through 19.0.8 allows local user to execute arbitrary JavaScript code by opening crafted URL in browser...

CVE-2021-31412

The CVE-2021-31412 entry describes an information-disclosure issue in Vaadin Flow Server’s default RouteNotFoundError view. The vulnerability arises from improper sanitization of the path, enabling a network attacker to enumerate all available routes when the application runs in production mode a...

CVE-2021-33604

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 Vaadin 14.0.0 through 14.6.1, 3.0.0 through 6.0.9 Vaadin 15.0.0 through 19.0.8 allows local user to execute arbitrary JavaScript code by opening crafted URL in browser...

CVE-2021-31412

Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 Vaadin 10.0.0 through 10.0.18, 1.1.0 prior to 2.0.0 Vaadin 11 prior to 14, 2.0.0 through 2.6.1 Vaadin 14.0.0 through 14.6.1, and 3.0.0 through 6.0.9 Vaadin 15.0.0 through 19.0....

vaadin:flow-server 输入验证错误漏洞

Vaadin flow is a software application.The Vaadin platform is a Java framework for building modern websites that look great, perform well and keep you and your users happy. A security vulnerability exists in vaadin:flow-server that stems from improper path cleanup in the default RouteNotFoundError...

PT-2021-19294 · Vaadin · Com.Vaadin:Flow-Server

Name of the Vulnerable Software and Affected Versions: com.vaadin:flow-server versions 1.0.0 through 1.0.14 com.vaadin:flow-server versions 1.1.0 prior to 2.0.0 com.vaadin:flow-server versions 2.0.0 through 2.6.1 com.vaadin:flow-server versions 3.0.0 through 6.0.9 Description: The issue is relate...

vaadin:flow-server 安全漏洞

Vaadin flow is a software application.The Vaadin platform is a Java framework for building modern websites that look great, perform well and keep you and your users happy. A security vulnerability exists in vaadin:flow-server that stems from a URL encoding error in the development mode handler. T...

Vaadin flow 安全漏洞

Vaadin flow is a software application. the Java framework for the Vaadin platform for building modern websites that look great, perform well and keep you and your users happy. A security vulnerability exists in vaadin that allows a local user to inject malicious code into front-end resources duri...

CVE-2021-31411

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 Vaadin 14.0.3 through Vaadin 14.5.2, 3.0 prior to 6.0 Vaadin 15 prior to 19, and 6.0.0 through 6.0.5 Vaadin 19.0.0 through 19.0.4 allows local users to inject malicious code...

Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 Vaadin 14.0.3 through Vaadin 14.5.2, 3.0 prior to 6.0 Vaadin 15 prior to 19, and 6.0.0 through 6.0.5 Vaadin 19.0.0 through 19.0.4 allows local users to inject malicious code...

Vaadin flow has an unspecified vulnerability

Vaadin flow is an application. vaadin platform Java framework for building modern websites that look good, perform well and keep you and your users happy. vaadin: flow-server versions 3.0.0 through 5.0.3 have a security vulnerability that can be exploited by attackers to guess the security token ...

CVE-2020-36319

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin 15.0.0 through 15.0.4 may expose sensitive data if the application also uses e.g. @RestController...

Design/Logic Flaw

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL...

CVE-2021-31407

Vulnerability: CVE-2021-31407 affects Vaadin’s OSGi integration in flow-server. Affected: com.vaadin:flow-server versions 1.2.0–2.4.7 (Vaadin 12.0.0–14.4.9) and 6.0.0–6.0.1 (Vaadin 19.0.0). Description: allows an attacker to access server-side application classes and resources via a crafted HTTP ...

CVE-2019-25027 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL...

CVE-2019-25027

The CVE-2019-25027 issue affects com.vaadin:flow-server, specifically the default RouteNotFoundError view. The vulnerability arises from missing output sanitization and affects versions 1.0.0–1.0.10 (Vaadin 10.0.0–10.0.13) and 1.1.0–1.4.2 (Vaadin 11.0.0–13.0.5), allowing an attacker to execute ma...