v.26.4.2314

Configuration

This page lists 405 vulnerabilities in this category.

Critical: 4 High: 127 Medium: 173 Low: 51 Information: 50

Vulnerability Name

CVE

CWE

Severity

Kentico Staging API Authentication Bypass

CVE-2025-2746

CWE-287

Critical

Unrestricted access to Apache HugeGraph

CWE-200

Critical

ASP.NET ViewState Weak Validation Key

CWE-321

Critical

Lucee Unset Admin Password

CWE-200

Critical

Trace.axd Detected

CWE-215

High

OSGi Management Console Default Credentials

CWE-521

High

RoR Database Configuration File Detected

CWE-538

High

Jupyter Notebook publicly accessible

CWE-78

High

Hadoop YARN ResourceManager publicly accessible

CWE-200

High

Unrestricted access to Haproxy Data Plane API

CWE-200

High

CouchDB REST API publicly accessible

CWE-285

High

Adobe Experience Manager Misconfiguration

CVE-2016-0957

CWE-693

High

Web Cache Poisoning through HTTP/2 pseudo-headers

CWE-44

High

Insecure Transportation Security Protocol Supported (SSLv2)

CWE-326

High

Insecure Transportation Security Protocol Supported (SSLv3)

CWE-326

High

Web Cache Poisoning

CWE-44

High

Reachable SharePoint interface

CWE-200

High

SharePoint user enumeration

CWE-200

High

Struts 2 development mode

CWE-489

High

Xdebug remote code execution via xdebug.remote_connect_back

CWE-200

High

MovableType remote code execution

CVE-2015-1592

CWE-94

High

BottlePy weak secret key

CWE-693

High

Jetpack 2.9.3: Critical Security Update

CVE-2014-0173

CWE-287

High

Multiple vulnerabilities in Ioncube loader-wizard.php

CWE-552

High

JAAS authentication bypass

CWE-693

High

JIRA Security Advisory 2013-02-21

CWE-22

High

Web Cache Poisoning via semicolon query separator

CWE-44

High

Apache Airflow Experimental API Auth Bypass CVE-2020-13927

CVE-2020-13927

CWE-200

High

Java Debug Wire Protocol remote code execution

CWE-94

High

Joomla 1.5 end of life

CWE-1104

High

Unrestricted access to Kong Gateway API

CWE-200

High

Joomla! 3.2.1 sql injection

CWE-89

High

Magento Cacheleak

CWE-200

High

MediaWiki remote code execution

CVE-2014-1610

CWE-20

High

Struts2 Development Mode Enabled

CWE-489

High

Unrestricted access to Caddy API interface

CWE-200

High

Delve Debugger Unauthorized Access Vulnerability

CWE-200

High

Pentaho API Auth bypass (CVE-2021-31602)

CVE-2021-31602

CWE-863

High

Joomla! Core Security Bypass

CVE-2017-11364

High

Atlassian Jira insecure REST permissions

High

Apache Geronimo default administrative credentials

CWE-693

High

Apache solr service exposed

CWE-200

High

Python Debugger Unauthorized Access Vulnerability

CWE-200

High

Padding oracle attack

CWE-209

High

Unprotected phpMyAdmin interface

CWE-205

High

Virtual Host locations misconfiguration

CWE-200

High

JBoss Web Console JMX Invoker

CWE-200

High

JBoss JMX Console Unrestricted Access

CWE-200

High

JBoss Server MBean

CWE-200

High

JBoss ServerInfo MBean

CVE-2010-0738

CWE-200

High

JBoss JMX management console

CWE-200

High

JBoss HttpAdaptor JMXInvokerServlet

CWE-94

High

JBoss BSHDeployer MBean

CWE-200

High

XML entity injection

CWE-611

High

Apache Tomcat insecure default administrative password

CVE-2009-3548

CWE-798

High

Ruby on Rails weak/known secret token

CVE-2013-0156

CWE-200

High

Jenkins Git Plugin missing permission check (CVE-2022-36883)

CVE-2022-36883

CWE-862

High

XML external entity injection (variant)

CWE-611

High

The Heartbleed Bug

CVE-2014-0160

CWE-200

High

Node.js Debugger Unauthorized Access Vulnerability

CWE-200

High

Insecure Transportation Security Protocol Supported (TLS 1.0)

CWE-326

High

Node.js Inspector Unauthorized Access Vulnerability

CWE-200

High

Nginx PHP code execution via FastCGI

CWE-94

High

Elmah.axd / Errorlog.axd Detected

CWE-209

High

Elasticsearch service accessible

CWE-200

High

CodeIgniter weak encryption key

CWE-200

High

XML external entity injection via File Upload

CWE-611

High

XML External Entity Injection via external file

CWE-611

High

XML external entity injection

CWE-611

High

XML external entity injection and XML injection

CWE-611

High

ASP.NET connection strings stored in plaintext

CWE-312

High

Roundcube security updates 0.8.6 and 0.7.3

CVE-2013-1904

CWE-22

High

RethinkDB administrative interface publicly exposed

CWE-200

High

JWT Signature Bypass via None Algorithm

CWE-345

High

qdPM Information Disclosure

CWE-260

High