Open Source Vulnerabilities

org.jenkins-ci.plugins:performance

XXE vulnerability in Jenkins Performance Plugin

org.jenkins-ci.plugins:dependency-check-jenkins-plugin

XXE vulnerability in Jenkins OWASP Dependency-Check Plugin

org.biouno:uno-choice

Stored XSS vulnerability in Jenkins Active Choices Plugin

apache-superset

Apache Superset allowed for database connections password leak for authenticated users

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

dolibarr/dolibarr

Dolibarr remote PHP code execution

github.com/apache/trafficcontrol, github.com/apache/trafficcontrol

Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection

Microsoft.ChakraCore

Chakra Scripting Engine and ChakraCore Vulnerable to Memory Corruption

ecdsa-elixir

ecdsa-elixir fails to check signatures, vulnerable to message forging

routinator

Routinator infinite loop vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Agent-to-controller access control allows reading/writing most content of build directories in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

org.jenkins-ci.plugins:subversion

Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files

obsidian-dataview

Obsidian Dataview vulnerable to code injection due to unsafe eval

com.typesafe.akka:akka-http-core_2.13.0-RC3, com.typesafe.akka:akka-http-core_2.13.0-RC2, com.typesafe.akka:akka-http-core_2.13.0-M5, com.typesafe.akka:aakka-http-core_2.13.0-M3, com.typesafe.akka:akka-http-core_2.13, com.typesafe.akka:akka-http-core_2.13, com.typesafe.akka:akka-http-core_2.12, com.typesafe.akka:akka-http-core_2.12, com.typesafe.akka:akka-http-core_2.11

Uncontrolled Recursion in Akka HTTP

org.springframework:spring-core, org.springframework:spring-core, org.springframework:spring, org.springframework:spring

Improper Output Neutralization for Logs in Spring Framework

org.springframework.data:spring-data-rest-core, org.springframework.data:spring-data-rest-core

Exposure of Resource to Wrong Sphere in Spring Data REST

org.springframework.amqp:spring-amqp, org.springframework.amqp:spring-amqp

Deserialization of Untrusted Data in Spring AMQP

org.springframework.cloud:spring-cloud-openfeign-core, org.springframework.cloud:spring-cloud-openfeign-core

Exposure of Resource to Wrong Sphere in Spring Cloud OpenFeign

froxlor/froxlor

Foxlor cross-site scripting (XSS) vulnerability

shell-quote

Improper Neutralization of Special Elements used in a Command in Shell-quote

mysql:mysql-connector-java

Incorrect Authorization in MySQL Connector Java

camaleon_cms

Camaleon CMS vulnerable to Uncaught Exception

camaleon_cms

Camaleon CMS vulnerable to Server-Side Request Forgery

grumpydictator/firefly-iii

Unrestricted File Upload vulnerability in Firefly III

edu.stanford.nlp:stanford-corenlp

Improper Restriction of XML External Entity Reference in Stanford CoreNLP

apache-superset

Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page

apache-superset

Apache Superset SQL Injection when template processing is enabled

edu.stanford.nlp:stanford-corenlp

Improper Restriction of XML External Entity Reference in Stanford CoreNLP

magento/community-edition, magento/community-edition, magento/community-edition, magento/community-edition, magento/project-community-edition

Magento Open Source allows Cross-Site Request Forgery (CSRF)

ops-cli

Ops CLI Deserialization of Untrusted Data vulnerability

froxlor/froxlor

Froxlor SQL injection vulnerability

mediawiki/core

MediaWiki allows a denial of service

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Path traversal vulnerability on Windows in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper handling of equivalent directory names on Windows in Jenkins

org.jenkins-ci.plugins:git

Stored XSS vulnerability in Jenkins Git Plugin

apollo_upload_server

apollo_upload_server has Denial of Service vulnerability

openvpn-monitor

furlongm openvpn-monitor command injection

openvpn-monitor

furlongm openvpn-monitor allows Authorization Bypass to disconnect arbitrary clients