v.26.4.2314

Configuration

This page lists 405 vulnerabilities in this category.

Critical: 4 High: 127 Medium: 173 Low: 51 Information: 50

Vulnerability Name

CVE

CWE

Severity

Devise weak password

CWE-200

High

Case-Insensitive Routing Bypass in Express.js Application

CWE-287

High

Apache Roller OGNL injection

CVE-2013-4212

CWE-20

High

Web Cache Deception

High

Harbor Unauthorized Access Vulnerability

CVE-2022-46463

CWE-200

High

Web application default/weak credentials

CWE-200

High

Webmail weak password

CWE-200

High

WebLogic admin console weak credentials

CWE-693

High

Weak password

CWE-200

High

SAP weak/predictable user credentials

CWE-200

High

Microsoft IIS5 NTLM and Basic authentication bypass

CVE-2007-2815

CWE-288

High

Jenkins weak password

CWE-200

High

Microsoft IIS WebDAV authentication bypass

CVE-2009-1535

CWE-287

High

IBM WebSphere administration console weak password

CWE-200

High

GlassFish admin console weak credentials

CWE-693

High

Apache Axis2 administration console weak password

CWE-200

High

Docker Engine API is accessible without authentication

CWE-287

High

Web Cache Poisoning via POST Request

CWE-44

High

Web Cache Poisoning via JSONP and UTM_ parameter

CWE-44

High

Web Cache Poisoning via Host Header

CWE-44

High

Code Execution via WebDav

CWE-434

High

WebDAV Directory Has Write Permissions

CWE-732

High

Web Cache Poisoning via Fat GET Request

CWE-44

High

IIS extended unicode directory traversal vulnerability

CVE-2000-0884

CWE-22

High

Adobe Experience Manager Expression Language injection via cloudsettings

CVE-2025-54246

CWE-94

High

Adobe Experience Manager SSRF via MS token verify servlet

CVE-2025-54246

CWE-918

High

Adobe Experience Manager Blind XXE via package upload

CVE-2025-54246

CWE-611

High

Adobe Experience Manager exposed user passwords via querybuilder

CVE-2025-54246

CWE-200

High

Adobe Experience Manager writable JCR nodes via querybuilder

CVE-2025-54246

CWE-276

High

JWT Signature is not Verified

CWE-287

High

JWT Signature Bypass via unvalidated jwk parameter

CWE-287

High

HTTP verb tampering via POST

CWE-285

High

Docker Registry API is accessible without authentication

CWE-287

High

Oracle E-Business Suite Information Disclosure

CWE-200

High

CodeIgniter session decoding vulnerability

CWE-327

High

Consul API publicly exposed

CWE-200

High

TorchServe Management API publicly exposed

CVE-2023-43654

CWE-200

High

SAP Management Console list logfiles

CWE-200

High

SAP Management Console get user list

CWE-200

High

Vulnerable project dependencies

CWE-1395

High

SAP Knowledge Management and Collaboration (KMC) incorrect permissions

CWE-285

High

PHP magic_quotes_gpc is disabled

CWE-150

High

Core dump file

CWE-200

High

Laravel Terminal open

CWE-200

High

Apache Spark Master Unauthorized Access Vulnerability

CWE-200

High

Apache REST RCE CVE-2018-11770

CVE-2018-11770

CWE-94

High

Apache Tapestry weak secret key

CWE-693

High

GoCD information disclosure (CVE-2021-43287)

CVE-2021-43287

CWE-200

High

Weak WordPress security key

CWE-326

High

Ruby framework weak secret key

CWE-693

High

Oracle PeopleSoft SSO weak secret key

CWE-693

High

Request Smuggling

CWE-444

High

The DROWN attack (SSLv2 supported)

CVE-2016-0800

CWE-327

High

Weak Secret is Used to Sign JWT

CWE-347

High

Method Tampering

CWE-285

High

Adobe ColdFusion 9 administrative login bypass

CVE-2013-0632

CWE-287

High

WebPageTest Unauthorized Access Vulnerability

CWE-200

Medium

Oracle E-Business Suite Frame Injection (CVE-2017-3528)

CVE-2017-3528

CWE-601

Medium

Pyramid DebugToolbar enabled

CWE-200

Medium

Atlassian JIRA Servicedesk misconfiguration

CWE-287

Medium

Adobe Experience Manager Information Disclosure via Apache Sling v2.3.6 vulnerability

CVE-2016-0956

CWE-668

Medium

Jetty Information Disclosure (CVE-2021-34429)

CVE-2021-28164

CWE-200

Medium

Django Debug Toolbar

CWE-200

Medium

Jenkins open user registration

CWE-200

Medium

Apache Kafka Unauthorized Access Vulnerability

CWE-200

Medium

Gitlab open user registration

CWE-200

Medium

Apache ZooKeeper Unauthorized Access Vulnerability

CWE-200

Medium

HTTP header reflected in cached response

CWE-79

Medium

Jetty ConcatServlet Information Disclosure (CVE-2021-28169)

CVE-2021-28169

CWE-200

Medium

Joomla J!Dump extension enabled

CWE-200

Medium

Web Cache Poisoning DoS through HTTP/2 headers

CWE-400

Medium

Spring Boot Misconfiguration: H2 console enabled

CWE-200

Medium

Joomla Debug Console enabled

CWE-200

Medium

Express Development Mode enabled

CWE-200

Medium

Phpfastcache phpinfo publicly accessible (CVE-2021-37704)

CVE-2021-37704

CWE-200

Medium