Flow Server
Approved changes feed: RSS · Atom
cpe:2.3:a:vaadin:flow-server:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Vaadin (34b94bf1-d464-500e-83b4-751a8d81d66e) |
|---|---|
| Product | Flow Server (bfc1431d-2399-5404-b1b1-349ed31b9d73) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/vaadin/flow |
purl2cpe | 2026-06-01 10:12:05.602066 |
pkg:maven/com.vaadin/flow |
purl2cpe | 2026-06-01 10:12:05.602067 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-25499 |
vulnerable | 2026-06-08 05:56:09.087283 |
Possible information disclosure in non visible components
MEDIUM (5.7)
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
Published: 2023-06-22T12:47:57.760Z
Updated: 2024-12-05T19:58:49.359Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-33604 |
vulnerable | 2026-06-08 05:32:11.872273 |
Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
LOW (2.5)
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
Published: 2021-06-24T11:16:27.149Z
Updated: 2024-09-17T03:13:22.641Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-31412 |
vulnerable | 2026-06-08 05:31:53.462580 |
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
MEDIUM (5.3)
Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.
Published: 2021-06-24T11:33:10.535Z
Updated: 2024-09-16T16:18:47.406Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-31411 |
vulnerable | 2026-06-08 05:31:53.462058 |
Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
MEDIUM (6.3)
Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.
Published: 2021-05-05T18:15:13.220Z
Updated: 2024-09-16T18:08:17.789Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-31407 |
vulnerable | 2026-06-08 05:31:53.455747 |
Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
HIGH (8.6)
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.
Published: 2021-04-23T16:05:41.485Z
Updated: 2024-09-16T17:17:43.411Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-31406 |
vulnerable | 2026-06-08 05:31:53.453224 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-31404 |
vulnerable | 2026-06-08 05:31:53.450334 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-36321 |
vulnerable | 2026-06-08 05:25:02.955643 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-36319 |
vulnerable | 2026-06-08 05:25:02.952391 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25027 |
vulnerable | 2026-06-08 05:13:41.835728 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25007 |
vulnerable | 2026-06-08 05:11:29.122869 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.