Open Source Vulnerabilities

ghostscript

Heap-buffer-overflow in Ins_PUSHW

octoprint

OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type

octoprint

OctoPrint Improper Privilege Management vulnerability

octoprint

OctoPrint vulnerable to Insufficient Session Expiration.

pimcore/pimcore

Pimcore vulnerable to cross site scripting

org.jenkins-ci.plugins:bigpanda-jenkins

Jenkins BigPanda Notifier Plugin stores BigPanda API key unencrypted

org.jenkins-ci.plugins:view26

Missing hostname validation in Jenkins View26 Test-Reporting Plugin

org.jenkins-ci.plugins:build-publisher

Missing permission check in Jenkins build-publisher Plugin

org.jenkins-ci.plugins:rundeck

Jenkins Rundeck Plugin Missing Authorization vulnerability

com.smalltest:smalltest

Jenkins SmallTest Plugin missing hostname validation

org.jenkins-ci.plugins:walti

Stored XSS vulnerability in Jenkins Walti plugin

org.jenkins-ci.plugins:security-inspector

CSRF vulnerability in Jenkins Security Inspector plugin

com.groupon.jenkins-ci.plugins:DotCi

Lack of authentication mechanism in Jenkins DotCi Plugin webhook

org.jenkins-ci.plugins:anchore-container-scanner

Jenkins Anchore Container Image Scanner Plugin vulnerable to cross site scripting

craftcms/cms, craftcms/cms

Craft CMS Cross-site Scripting vulnerability

org.jenkins-ci.plugins:wildfly-deployer

Jenkins WildFly Deployer Plugin vulnerable to path traversal

io.jenkins.plugins:cavisson-ns-nd-integration

Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-site Scripting

com.compuware.jenkins:compuware-common-configuration

Jenkins Compuware Common Configuration Plugin vulnerable to Improper Restriction of XML External Entity Reference

org.jenkins-ci.plugins:ws-execution-manager

CSRF vulnerability in Jenkins Worksoft Execution Manager Plugin allows capturing credentials

io.jenkins.plugins:cavisson-ns-nd-integration

Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Missing Authorization

net.praqma:rqm-plugin

Jenkins RQM Plugin vulnerable to Improper Restriction of XML External Entity Reference

io.jenkins.plugins:cavisson-ns-nd-integration

Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-Site Request Forgery

org.jenkins-ci.plugins:build-publisher

Path traversal in Jenkins build-publisher Plugin

org.jenkins-ci.plugins:extreme-feedback

Jenkins extreme-feedback Plugin vulnerable to Missing Authorization

org.jenkins-ci.plugins:ws-execution-manager

CSRF vulnerability and mM

org.jenkins-ci.plugins:build-publisher

Jenkins build-publisher plugin vulnerable to cross-site request forgery

com.groupon.jenkins-ci.plugins:DotCi

Stored XSS vulnerability in Jenkins DotCi Plugin

org.jenkins-ci.plugins:rundeck

Missing webhook endpoint authorization in Jenkins Rundeck Plugin

com.groupon.jenkins-ci.plugins:DotCi

RCE vulnerability in Jenkins DotCi Plugin

org.jenkins-ci.main:jenkins-core

Jenkins vulnerable to stored cross site scripting in the I:helpIcon component

org.jenkins-ci.plugins:cons3rt

CSRF vulnerability in Jenkins CONS3RT Plugin allow capturing credentials

org.jenkins-ci.plugins:apprenda

Jenkins Apprenda Plugin has Missing Authorization vulnerability

com.meowlomo.jenkins:scm-httpclient

Jenkins SCM HttpClient Plugin vulnerable to Cross-Site Request Forgery

org.jenkins-ci.plugins:cons3rt

Missing permission checks in Jenkins CONS3RT Plugin allow capturing credentials

org.jenkins-ci.plugins:bigpanda-jenkins

Jenkins BigPanda Notifier Plugin Missing Password Field Masking

org.jenkins-ci.plugins:cons3rt

API token stored in plain text by Jenkins CONS3RT Plugin

org.jenkins-ci.plugins:cons3rt

Missing permission checks in Jenkins CONS3RT Plugin allow enumerating credentials IDs

com.meowlomo.jenkins:scm-httpclient

Missing permission check in Jenkins SCM HttpClient Plugin allow capturing credentials

org.springframework.data:spring-data-rest-core, org.springframework.data:spring-data-rest-core

Spring Data REST can expose hidden entity attributes

rdiffweb

rdiffweb has insecure HTTP cookies

awesome-support/awesome-support

Awesome Support vulnerable to persistent cross-site scripting

rdiffweb

rdiffweb CSRF could lead to disabling notifications in user profile

expat

expat - security update

bind9

bind9 - security update

unzip

unzip - security update

mediawiki

mediawiki - security update

Jar url should be blocked by DefaultScriptSecurity

PDFTranscoder does not block external resources