Open Source Vulnerabilities

lmdb

py-lmdb Invalid write operation

org.apache.solr:solr-core

Apache Solr vulnerable to XML Bomb

bolt/bolt

Bolt Cross-site Scripting (XSS) via an image's alt or title field

jsdecena/laracom

laracom Cross-site Scripting

com.github.kevinsawicki:http-request

kevinsawicki/http-request Missing certificate validation

ServiceStack

Cross site scripting attack in ServiceStack Framework

typo3/cms-core, typo3/cms-core, typo3/cms, typo3/cms

Typo3 Cross-Site Scripting in Link Handling

typo3/cms-core, typo3/cms-core, typo3/cms, typo3/cms

TYPO3 Vulnerable to Insecure Deserialization

shopware/shopware

Shopware Cross-site Scripting Vulnerability

Microsoft.ChakraCore

ChakraCore RCE via Out-of-bounds write

Microsoft.ChakraCore

Chakra Scripting Engine RCE via Out-of-bounds write

Microsoft.ChakraCore

Chakra Scripting Engine RCE Vulnerability

Microsoft.ChakraCore

Chakra Scripting Engine RCE via Out-of-bounds write

org.jenkins-ci.plugins:pipeline-maven

XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin

org.jenkins-ci.plugins:artifactory

Cross-site request forgery vulnerability in Jenkins Artifactory Plugin

io.jenkins.plugins:warnings-ng

Jenkins Warnings NG Plugin cross-site request forgery vulnerability

org.jenkins-ci.plugins:gitea

Improper handling of untrusted branches in Gitea Jenkins Plugin

org.jenkins-ci.plugins:influxdb

Plaintext password storage in Jenkins InfluxDB Plugin

org.jenkins-ci.plugins:workflow-remote-loader

Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin

io.jenkins.plugins:warnings-ng

Jenkins Warnings NG Plugin Cross-site scripting vulnerability

org.jenkins-ci.plugins:artifactory

Jenkins Artifactory Plugin missing permission check

org.jenkins-ci.plugins:artifactory

Jenkins Artifactory Plugin cross-site request forgery vulnerability

org.jenkins-ci.plugins:artifactory

Jenkins Artifactory Plugin missing permission check

typo3/cms-core, typo3/cms-core, typo3/cms, typo3/cms

TYPO3 Image Processing susceptible to Code Execution

org.opencms:opencms-core

Alkacon OpenCMS XSS via New User module

totp-rs

Observable Timing Discrepancy in totp-rs

github.com/cilium/cilium, github.com/cilium/cilium, github.com/cilium/cilium

Improper Privilege Management in Cilium

github.com/cilium/cilium, github.com/cilium/cilium, github.com/cilium/cilium

Access to Unix domain socket can lead to privileges escalation in Cilium

github.com/charmbracelet/charm

Server-Side Request Forgery in charm

github.com/ethereum/go-ethereum

DoS via malicious p2p message in Go Ethereum

github.com/theupdateframework/go-tuf

Improper Validation of Integrity Check Value in go-tuf

auth0-lock

Cross-site Scripting in Auth0 Lock

gogs.io/gogs

Cross-site Scripting in Gogs

github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd

Argo CD will blindly trust JWT claims if anonymous access is enabled

linux-oem-5.14, linux-oem-5.17

linux-oem-5.14, linux-oem-5.17 vulnerability

stdlib

Mishandled trust preferences for root certificates on Darwin in crypto/x509

toolchain

Buffer overflow in WASM modules in misc/wasm and cmd/link

stdlib

Panic on invalid DSA public keys in crypto/dsa

htmldoc, htmldoc

htmldoc vulnerability

linux-aws-5.4, linux-azure-5.4, linux-gke-5.4, linux-hwe-5.4, linux, linux-aws, linux-azure, linux-azure-fde, linux-gcp, linux-gke, linux-ibm, linux-kvm

linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-azure-fde, linux-gcp, linux-gke, linux-gke-5.4, linux-hwe-5.4, linux-ibm, linux-kvm vulnerabilities

linux-azure, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-oracle, linux, linux-aws, linux-azure-4.15, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon, linux-aws-5.13, linux-azure-5.13, linux-hwe-5.13, linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi

linux, linux-aws, linux-aws-hwe, linux-aws-5.13, linux-azure, linux-azure-5.13, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke, linux-hwe, linux-hwe-5.13, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, linux-raspi2, linux-snapdragon vulnerabilities

ec-cube/ec-cube

EC-CUBE Cross-site request forgery (CSRF) vulnerability

moodle/moodle, moodle/moodle, moodle/moodle

Moodle contains CSRF vulnerability

asterix-decoder

Asterix Heap-based Buffer Overflow

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Insecure direct object reference (IDOR) in a calendar web service

apache-superset

Improper Encoding or Escaping of Output in Apache Superset

org.jenkins-ci.plugins:scriptler

Stored XSS vulnerability in Jenkins Scriptler Plugin

org.jenkins-ci.plugins:pom2config

XXE vulnerability in Jenkins pom2config Plugin

org.jenkins-ci.plugins:squashtm-publisher-plugin

Agent-to-controller security bypass in Jenkins Squash TM Publisher (Squash4Jenkins) Plugin allows writing arbitrary files