Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Vaadin ausnutzen, um einen Cross-Site Scripting Angriff oder einen Denial-of-Service-Angriff durchzuführen oder beliebigen Programmcode auszuführen.
Product
Vaadin ist eine Java Web Entwicklungsplattform.
Vulnerabilities 2
-
High 8.7
Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so th…
-
High 8.4
Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vu…
Revision history
-
#1
Initiale Fassung
References
-
Vaadin Security Advisory vom 2026-10-21
https://vaadin.com/security/cve-2026-107588
-
Vaadin Security Advisory vom 2026-10-21
https://vaadin.com/security/cve-2026-110803