Skip to content

Vendor

playframework vulnerabilities

4 published CVES affecting playframework, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
1
High
3
Medium
0
Low
0
Unscored
0
CISA KEV
0
Atom feed of playframework alerts

Products

Latest playframework CVEs

Newest publication first

  1. CVE-2022-31023 Dev error stack trace leaking into prod in Play Framework

    Published
    HighCVSS 7.5

    Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play d...

  2. CVE-2022-31018 Denial of service binding form from JSON in Play Framework

    Published
    HighCVSS 7.5 EPSS 1.7%

    Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the Form#bindFromRequest method on a JSON request...

  3. CVE-2014-3630 XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of ser...

    Published
    CriticalCVSS 9.8

    XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.

  4. CVE-2015-2156 Information Exposure in Netty

    Published
    HighCVSS 7.5

    Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.