com.vaadin:vaadin-bom (Maven)
Advisories
33
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 20.0.6 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>com.vaadin</groupId><artifactId>vaadin-bom</artifactId><version>20.0.6</version></dependency>gradle
implementation("com.vaadin:vaadin-bom:20.0.6")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-93c4-vf86-3rj7 Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14 |
Medium EPSS 0.99% |
>= 14.0.0, < 14.4.5 | 14.4.5 |
| GHSA-jfmf-w293-8xr8 Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8 |
High | >= 8.0.0, < 8.13.0 | 8.13.0 |
| GHSA-hw7r-qrhp-5pff Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20 |
Medium | >= 15.0.0, < 20.0.6 | 20.0.6 |
| GHSA-hw7r-qrhp-5pff Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20 |
Medium | >= 12.0.0, < 14.6.8 | 14.6.8 |
| GHSA-c99r-67x4-whj6 Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 |
Low EPSS 0.29% |
>= 15.0.0, < 19.0.9 | 19.0.9 |
| GHSA-c99r-67x4-whj6 Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 |
Low EPSS 0.29% |
>= 14.0.0, < 14.6.2 | 14.6.2 |
| GHSA-qrg9-f472-qwfm Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 |
Medium EPSS 1.32% |
>= 15.0.0, < 19.0.9 | 19.0.9 |
| GHSA-qrg9-f472-qwfm Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 |
Medium EPSS 1.32% |
>= 10.0.0, < 10.0.19 | 10.0.19 |
| GHSA-qrg9-f472-qwfm Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 |
Medium EPSS 1.32% |
>= 11.0.0, < 14.6.2 | 14.6.2 |
| GHSA-p826-8vhq-h439 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 |
Medium EPSS 0.23% |
>= 14.0.3, < 14.5.3 | 14.5.3 |
| GHSA-p826-8vhq-h439 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 |
Medium EPSS 0.23% |
>= 15.0.0, < 19.0.5 | 19.0.5 |
| GHSA-mr8h-j9cv-4m8h Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 |
Medium EPSS 0.32% |
>= 18.0.0, < 19.0.4 | 19.0.4 |
| GHSA-75xc-qvxh-27f8 Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8 |
Medium EPSS 0.31% |
>= 8.0.0, < 8.12.3 | 8.12.3 |
| GHSA-75xc-qvxh-27f8 Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8 |
Medium EPSS 0.31% |
>= 7.0.0, < 7.7.24 | 7.7.24 |
| GHSA-q74r-4xw3-ppx9 Stored cross-site scripting in Grid component in Vaadin 7 and 8 |
Medium EPSS 0.92% |
>= 7.4.0, < 7.7.20 | 7.7.20 |
| GHSA-q74r-4xw3-ppx9 Stored cross-site scripting in Grid component in Vaadin 7 and 8 |
Medium EPSS 0.92% |
>= 8.0.0, < 8.8.5 | 8.8.5 |
| GHSA-42j4-733x-5vcf Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7 |
High EPSS 1.96% |
>= 7.0.0.beta1, < 7.7.22 | 7.7.22 |
| GHSA-3h5r-928v-mxhh Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 |
Low | >= 10.0.0, < 10.0.8 | 10.0.8 |
| GHSA-3h5r-928v-mxhh Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 |
Low | >= 11.0.0, < 11.0.3 | 11.0.3 |
| GHSA-jqj4-r483-4gvr Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 |
Medium | >= 10.0.0, < 10.0.14 | 10.0.14 |
| GHSA-jqj4-r483-4gvr Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 |
Medium | >= 11.0.0, < 13.0.6 | 13.0.6 |
| GHSA-76f4-fw33-6j2v Potential sensitive data exposure in applications using Vaadin 15 |
Low | >= 15.0.0, < 15.0.5 | 15.0.5 |
| GHSA-82mf-mmh7-hxp5 Directory traversal in development mode handler in Vaadin 14 and 15-17 |
Medium | >= 14.0.0, < 14.4.3 | 14.4.3 |
| GHSA-82mf-mmh7-hxp5 Directory traversal in development mode handler in Vaadin 14 and 15-17 |
Medium | >= 15.0.0, < 18.0.0 | 18.0.0 |
| GHSA-c6c4-7x48-4cqp Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 |
Medium | >= 11.0.0, < 14.4.7 | 14.4.7 |
| GHSA-c6c4-7x48-4cqp Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 |
Medium | >= 10.0.0, < 10.0.17 | 10.0.17 |
| GHSA-c6c4-7x48-4cqp Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18 |
Medium | >= 15.0.0, < 18.0.6 | 18.0.6 |
| GHSA-2wqp-jmcc-mc77 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 |
High EPSS 1.13% |
>= 14.0.6, < 14.4.4 | 14.4.4 |
| GHSA-2wqp-jmcc-mc77 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 |
High EPSS 1.13% |
>= 15.0.0, < 17.0.11 | 17.0.11 |
| GHSA-9h6g-6mxg-vvp4 Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 |
Medium | >= 15.0.0, < 18.0.7 | 18.0.7 |
| GHSA-9h6g-6mxg-vvp4 Timing side channel vulnerability in endpoint request handler in Vaadin 15-19 |
Medium | >= 19.0.0, < 19.0.1 | 19.0.1 |
| GHSA-j9wr-49vq-rm5g Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 |
High | >= 19.0.0, < 19.0.1 | 19.0.1 |
| GHSA-j9wr-49vq-rm5g Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 |
High | >= 12.0.0, < 14.4.10 | 14.4.10 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor