Vaadin

Vaadin

26 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2021-31412

  • EPSS 0.69%
  • Veröffentlicht 24.06.2021 12:15:08
  • Zuletzt bearbeitet 21.11.2024 06:05:37

Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1)...

7.5

CVE-2021-31409

  • EPSS 0.72%
  • Veröffentlicht 06.05.2021 13:15:12
  • Zuletzt bearbeitet 21.11.2024 06:05:36

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious ema...

7.8

CVE-2021-31411

  • EPSS 0.05%
  • Veröffentlicht 05.05.2021 19:15:08
  • Zuletzt bearbeitet 21.11.2024 06:05:36

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through ...

7.1

CVE-2021-31408

  • EPSS 0.05%
  • Veröffentlicht 23.04.2021 17:15:08
  • Zuletzt bearbeitet 21.11.2024 06:05:36

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows ...

7.5

CVE-2021-31407

  • EPSS 1.8%
  • Veröffentlicht 23.04.2021 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:05:36

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTT...

2.5

CVE-2021-31406

  • EPSS 0.05%
  • Veröffentlicht 23.04.2021 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:05:35

Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a sec...

7.5

CVE-2021-31405

  • EPSS 0.47%
  • Veröffentlicht 23.04.2021 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:05:35

Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource ...

2.5

CVE-2021-31404

  • EPSS 0.05%
  • Veröffentlicht 23.04.2021 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:05:35

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4...

2.5

CVE-2021-31403

  • EPSS 0.11%
  • Veröffentlicht 23.04.2021 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:05:35

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security to...

7.5

CVE-2020-36321

  • EPSS 0.55%
  • Veröffentlicht 23.04.2021 16:15:08
  • Zuletzt bearbeitet 21.11.2024 05:29:16

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of inten...