{"action":"Upgrade com.vaadin:vaadin-bom to 10.0.14 (10.x) or 13.0.6 (13.x) or later.","affected":[{"fixed":"10.0.14","introduced":"10.0.0"},{"fixed":"13.0.6","introduced":"11.0.0"}],"component":"com.vaadin:vaadin-bom","cve_ids":[],"ecosystem":"Maven","exploited":false,"fixed_versions":["10.0.14","13.0.6"],"ghsa_id":"GHSA-jqj4-r483-4gvr","id":"tcs_01M5N93GG85NEWQHTY0QV5B17B","modified_at":"2024-12-02T05:40:30.078372Z","published_at":"2021-04-19T14:48:51Z","references":["https://osv.dev/vulnerability/GHSA-jqj4-r483-4gvr","https://github.com/vaadin/platform/security/advisories/GHSA-jqj4-r483-4gvr","https://github.com/vaadin/platform","https://vaadin.com/security/cve-2019-25027"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-jqj4-r483-4gvr","url":"https://osv.dev/vulnerability/GHSA-jqj4-r483-4gvr"}],"summary":"Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13"}