Flow Security Vulnerabilities and Issues — Flow CVE List

Lucene search

VaadinFlow

2 matches found

CVE•added 2021/04/23 4:15 p.m.•67 views

CVE-2020-36319

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController

6.5CVSS5AI score0.005EPSS

CVE•added 2021/04/23 4:15 p.m.•62 views

CVE-2019-25027

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL

6.1CVSS6.2AI score0.00371EPSS