Vaadin flow-server vulnerabilities

CVEs per yearBy the year they were published

1. 20216
2. 20212
3. 20211
4. 20211
5. 20231

Newest CVEs

• CVE-2023-25499

  Possible information disclosure in non visible components

  vaadin · vaadin

  Medium5.7
• CVE-2021-31412

  Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19

  Vaadin · Vaadin

  Medium5.3
• CVE-2021-33604

  Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

  Vaadin · Vaadin

  Low2.5
• CVE-2021-31411

  Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

  Vaadin · Vaadin

  Medium6.3
• CVE-2021-31407

  Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

  Vaadin · Vaadin

  High8.6
• CVE-2021-31406

  Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

  Vaadin · Vaadin

  Medium4.0
• CVE-2021-31404

  Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18

  Vaadin · Vaadin

  Medium4.0
• CVE-2020-36321

  Directory traversal in development mode handler in Vaadin 14 and 15-17

  Vaadin · Vaadin

  Medium5.9
• CVE-2020-36319

  Potential sensitive data exposure in applications using Vaadin 15

  Vaadin · Vaadin

  Low3.1
• CVE-2019-25027

  Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

  Vaadin · Vaadin

  Medium6.1