| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 22.0.0 - 23.6.15
Vaadin 24.0.0 - 24.4.23
Vaadin 24.5.0 - 24.7.15
Vaadin 24.8.0 - 24.9.22
Vaadin 24.10.0 - 24.10.10
Vaadin 25.0.0 - 25.2.9
Vaadin 25.3.0
Mitigation
Upgrade to 23.6.16
Upgrade to 24.4.24
Upgrade to 24.7.16
Upgrade to 24.9.23
Upgrade to 24.10.11
Upgrade to 25.2.10
Upgrade to 25.3.1 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.
Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16
com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24
com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16
com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23
com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11
com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10
com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10
com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10
com.vaadin:vaadin / 25.3.0 / >=25.3.1
com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16
com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24
com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15
com.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23
com.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11
com.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10
com.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10
com.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10
com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1
com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16
com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24
com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15
com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23
com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11
com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10
com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10
com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10
com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1
npm packages
npm package / Vulnerable versions / Fixed version
@vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7
@vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19
@vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13
@vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19
@vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7
@vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14
@vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14
@vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14
@vaadin/charts / 25.3.0 / >=25.3.1 |
| ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server. This issue is fixed in version 7.1.2-31. |
| A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query of the file profile.php. The manipulation of the argument admin_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. |
| Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). |
| The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database. |
| The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock. |
| The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor. |
| The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains. |
| The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price. |
| ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31. |
| filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1. |
| SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused. |
| filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1. |
| The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total. |
| A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file returned_book_search.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. |
| pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF. |
| Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the <path>.rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1. |
