The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Unsafe validation RegEx in the EmailField component of com.vaadin:vaadin-text-field-flow allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Improper URL validation in development mode handler in com.vaadin:flow-server allows attacker to request arbitrary files stored outside of intended frontend resources folder.
Authentication.logout() helper in com.vaadin:flow-client uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.
A non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server, and com.vaadin:fusion-endpoint allows an attacker to guess a security token for Fusion endpoints via timing attack.
A non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server allows attacker to guess a security token via timing attack.
A non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server allows attacker to guess a security token via timing attack.
Insecure configuration of default ObjectMapper in com.vaadin:flow-server may expose sensitive data if the application also uses @RestController
A vulnerability in OSGi integration in com.vaadin:flow-server allows attacker to access application classes and resources on the server via crafted HTTP request.
Cross-Site Request Forgery (CSRF) in com.vaadin:flow-client.