Lightbend / Play Framework
11 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2022-31023 | Dev error stack trace leaking into prod in Play Framework | HIGH | 7.5 | Jun 2, 2022 |
| CVE-2022-31018 | Denial of service binding form from JSON in Play Framework | HIGH | 7.5 | Jun 2, 2022 |
| CVE-2020-28923 | An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects us… | LOW | 2.7 | Dec 3, 2020 |
| CVE-2020-26882 | In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input. | HIGH | 7.5 | Nov 6, 2020 |
| CVE-2020-27196 | An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type head… | HIGH | 7.5 | Nov 6, 2020 |
| CVE-2020-26883 | In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents. | HIGH | 7.5 | Nov 6, 2020 |
| CVE-2020-12480 | In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be… | MEDIUM | 6.5 | Aug 17, 2020 |
| CVE-2019-17598 | An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may somet… | HIGH | 7.5 | Nov 5, 2019 |
| CVE-2018-13864 | A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows.… | HIGH | 7.5 | Jul 17, 2018 |
| CVE-2014-3630 | XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to re… | CRITICAL | 9.8 | Dec 29, 2017 |
| CVE-2015-2156 | netty: HttpOnly cookie bypass | HIGH | 7.5 | Oct 18, 2017 |
Showing 1 to 11 of 11 CVEs