CVE-2025-9467 Possibility to bypass file upload validation on the server-side

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 -...

Vaadin 安全漏洞

Vaadin is an open source platform for web application development from Vaadin Open Source.The Vaadin platform consists of a set of web components, a Java web framework, and a set of tools and application launchers. A security vulnerability exists in Vaadin, which stems from an upload validation...

PT-2025-35893

Name of the Vulnerable Software and Affected Versions: Vaadin versions 7.0.0 through 7.7.47 Vaadin versions 8.0.0 through 8.28.1 Vaadin versions 14.0.0 through 14.13.0 Vaadin versions 23.0.0 through 23.6.1 Vaadin versions 24.0.0 through 24.7.6 Description: The Vaadin Upload component’s start...

Possibility to bypass file upload validation on the server-side

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. See CWE-20 Improper Input Validation Description When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is...

at.ganzleicht.vaadin:vaadin-server (>=9.1.1, <=9.1.3), br.com.thiagomoreira.liferay.plugins.fix-virtual-host-app:fix-virtual-host-hook (>=2.0.0, <=5.1.0) +663 more potentially affected by CVE-2025-43740 via com.liferay.portal:com.liferay.portal.kernel (>=1.0.0, <=166.0.0)

com.liferay.portal:com.liferay.portal.kernel MAVEN version =1.0.0, =9.1.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.0.2.release, =0.0.2.release, =0.0.2.release, =0.0.2.release, =0.0.2.release, =1.0.0.release - com.gitee.pif...

Ingress-Nginx Admission Controller RCE Escalation

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

This Week in Spring – March 18th, 2025

Hi, Spring fans! I just got back from the amazing JavaOne show held in Redwood Shores. It was a fun, uproarious event and a great chance to reconnect with tons of friends, old and new. I love this community! One of the central highlights of this show? Java 24 is here, finally! And, as usual, we'v...

This Week in Spring - October 22nd, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring. I write this to you in an Uber speeding down the autobahn near Frankfurt, Germany. What a time to be alive! At the rate this driver's going, I won't have much time to write this before we've arrived, so let's dive right into...

A Bootiful Podcast: Vaadin developer advocacy legend Marcus Hellberg

Hi, Spring fans! In this installment, I talk to Vaadin developer advocacy legend Marcus Hellberg about the lates-and-greatest in the wide and wonderful world of Spring...

This Week in Spring - September 5th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? I just got back from another fabulous labor day weekend, and am headed to Oslo, Norway, for the fabulous JavaZone 2023 event. This will be my first time returning to lovely Oslo, Norway, since the pandemic! I can...

A Bootiful Podcast: Java legend Simon Martinelli on Vaadin, JavaOOQ, and so more

Hi Spring fans! In this installment Josh Long talks to Java legend Simon Martinelli about Vaadin, Spring, JavaOOQ, and more. This episode was recorded live from beautiful Barcelona, Spain at the amazing Spring I/O show!...

Information Exposure

vaadin is vulnerable to Information Exposure. The vulnerability exists due to a lack of validation for non-visible components in the UI on the server side, which allows an attacker to access sensitive information...

Information Disclosure

Vaadin is vulnerable to Information Disclosure. The vulnerability exists due to lack of masking sensitive debug messages which allows an attacker to view information such as class and method names included in RPC responses by sending modified requests...

GHSA-5F9V-MV5G-JH5Q Vaadin vulnerable to possible information disclosure in non visible components.

Description When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential...

Vaadin vulnerable to possible information disclosure in non visible components.

Description When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential...

Vaadin vulnerable to possible information disclosure of class and method names in RPC response

Description Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests...

GHSA-CH48-9R3Q-PV7X Vaadin vulnerable to possible information disclosure of class and method names in RPC response

Description Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests...

CVE-2023-25500

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests...

CVE-2023-25499

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information...

Information disclosure

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information...