- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9 · 2 high, 6 medium, 1 low
- Registry
- Maven Central
Advisories 9
- CVE-2021-33611Medium 6.1
Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
Affected: from 14.0.0, fixed in 14.4.5.
- CVE-2021-31412Medium 5.3
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Affected: from 10.0.0, fixed in 10.0.19; from 11.0.0, fixed in 14.6.2; from 15.0.0, fixed in 19.0.9.
- CVE-2021-33604Low 2.5
Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
Affected: from 14.0.0, fixed in 14.6.2; from 15.0.0, fixed in 19.0.9.
- CVE-2021-31411Medium 6.3
Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
Affected: from 14.0.3, fixed in 14.5.3; from 15.0.0, fixed in 19.0.5.
- CVE-2021-31408Medium 6.3
Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Affected: from 18.0.0, fixed in 19.0.4.
- CVE-2021-31405High 7.5
Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Affected: from 14.0.6, fixed in 14.4.4; from 15.0.0, fixed in 17.0.11.
- CVE-2021-31403Medium 4.0
Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8
Affected: from 7.0.0, fixed in 7.7.24; from 8.0.0, fixed in 8.12.3.
- CVE-2020-36320High 7.5
Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7
Affected: from 7.0.0.beta1, fixed in 7.7.22.
- CVE-2019-25028Medium 5.4
Stored cross-site scripting in Grid component in Vaadin 7 and 8
Affected: from 7.4.0, fixed in 7.7.20; from 8.0.0, fixed in 8.8.5.