Play Framework vulnerabilitiesRanked by how likely they are to be used.
Play Framework is made by Lightbend. We track 11 published vulnerabilities in it, across 121 versions. None of them is on the list of flaws known to be exploited today. If you run Play Framework, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Play Framework vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Play Framework's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Play Framework flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 5.2%CVE-2015-2156High
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies...
- 3.4%CVE-2018-13864High
A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows.
- 2.9%CVE-2014-3630Critical
XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have...
- 1.7%CVE-2022-31018High
Play Framework is a web framework for Java and Scala.
- 1.4%CVE-2020-26882High
In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.
- 1.4%CVE-2020-26883High
In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.
- 1.4%CVE-2020-27196High
An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2.
- 1.3%CVE-2022-31023High
Play Framework is a web framework for Java and Scala.
- 1.0%
An issue was discovered in Play Framework 2.8.0 through 2.8.4.
- 0.7%CVE-2019-17598High
An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23.
Running Play Framework? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
- Matched to
- Play Framework on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 11 published vulnerabilities listed under the name Play Framework, across 121 versions.
None of Play Framework's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Play Framework. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.