9228 matches found
Information Disclosure
flow-server is vulnerable to information disclosure. Non-constant-time comparison of CSRF tokens in endpoint request handler allows an attacker to discover a security token for Fusion endpoints via timing attack...
Cross-Site Scripting (XSS)
flow-server is vulnerable to cross-site scripting. The vulnerability exists due to the use of the HTML input not sanitized before added to the template...
Cross-Site Scripting (XSS)
flow-server is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbtirary Javascript in a user's browser via the error template...
Directory Traversal
flow-server is vulnerable to directory traversal. The attack is possible due to a lack of proper validation of URL path, allowing an attacker to inject ../ characters into in parameters to access resources outside of the web root...
Regular Expression Denial Of Service (ReDoS)
vaadin-text-field-flow is vulnerable to regular expression denial of service. Unsafe validation RegEx in EmailField allows an attacker to cause excessive CPU usage which could lead to a denial of service condition...
Stable Channel Update for Desktop
The Stable channel has been updated to 90.0.4430.85 for Windows, Mac and Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by...
CVE-2021-29455
Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT...
Nextcloud: Targeted phishing attacks in Login flow v2
Vulnerability description not provided...
GHSA-CRH4-294P-VCFQ Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 Vaadin 14.0.6 through 14.4.3, and 3.0.0 through 4.0.2 Vaadin 15.0.0 through 17.0.10 allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses...
GHSA-RP4X-WXQV-CF9M Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 Vaadin 10.0.0 through 10.0.13, and 1.1.0 through 1.4.2 Vaadin 11.0.0 through 13.0.5 allows attacker to execute malicious JavaScript via crafted URL. -...
Potential sensitive data exposure in applications using Vaadin 15
Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin 15.0.0 through 15.0.4 may expose sensitive data if the application also uses e.g. @RestController - https://vaadin.com/security/cve-2020-36319...
GHSA-RJWW-2X8V-M9V9 Potential sensitive data exposure in applications using Vaadin 15
Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin 15.0.0 through 15.0.4 may expose sensitive data if the application also uses e.g. @RestController - https://vaadin.com/security/cve-2020-36319...
GHSA-49R2-73M6-PP8F Directory traversal in development mode handler in Vaadin 14 and 15-17
Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder. -...
GHSA-3H5R-928V-MXHH Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2 allows attacker to update element property values via crafted synchronization message. - https://vaadin.com/security/cve-2018-25007...
GHSA-C6C4-7X48-4CQP Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 Vaadin 10.0.0 through 10.0.16, 1.1.0 prior to 2.0.0 Vaadin 11 prior to 14, 2.0.0 through 2.4.6 Vaadin 14.0.0 through 14.4.6, 3.0.0 prior to 5.0.0 Vaadin 15 prior to 18, and...
Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 Vaadin 14.0.6 through 14.4.3, and 3.0.0 through 4.0.2 Vaadin 15.0.0 through 17.0.10 allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses...
PT-2021-12003 · Vaadin · Com.Vaadin:Flow-Server +1
Name of the Vulnerable Software and Affected Versions: com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin versions 15.0.0 through 15.0.4 Description: The issue is related to an insecure configuration of the default ObjectMapper in the affected software. This may expose sensitive data if t...
PT-2021-19288 · Vaadin · Com.Vaadin:Flow-Server
Name of the Vulnerable Software and Affected Versions: com.vaadin:flow-server versions 1.2.0 through 2.4.7 com.vaadin:flow-server versions 6.0.0 through 6.0.1 Description: The issue allows an attacker to access application classes and resources on the server via a crafted HTTP request. This is du...
PT-2021-19286
Name of the Vulnerable Software and Affected Versions com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 com.vaadin:vaadin-text-field-flow versions 3.0.0 through 4.0.2 Description The issue is related to an unsafe validation RegEx in the EmailField component, which allows attackers to...