Skip to content
OpenAdvisories

Product · vaadin

flow-server

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.5
    CVE-2021-33604

    Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

    URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted …

    vaadin vaadin flow-server com.vaadin:vaadin-bom Maven
  • Low 3.1
    CVE-2020-36319

    Potential sensitive data exposure in applications using Vaadin 15

    Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController

    vaadin vaadin flow-server com.vaadin:flow-server Maven
  • Low 2.6
    CVE-2018-25007

    Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

    Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

    vaadin vaadin flow-server com.vaadin:flow-server Maven