Open Source Vulnerabilities

drupal/core, drupal/core, drupal/core, drupal/drupal, drupal/drupal, drupal/drupal

Drupal Core Access bypass vulnerability

com.liferay.portal:release.portal.bom

Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin Page

com.liferay.portal:release.dxp.bom

Liferay DXP Vulnerable to Denial-of-service (DoS) in the Multi-Factor Authentication Module

com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom, com.liferay.portal:release.dxp.bom, com.liferay.portal:release.dxp.bom

Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages

com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom

Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use

nokogiri

Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing

mongodb.driver

MongoDB C# Driver Risk of Exposing Authentication Data via Command Listener

org.jboss:jboss-ejb-client

JBoss EJB Client information disclosure vulnerability

org.elasticsearch:elasticsearch, org.elasticsearch:elasticsearch

Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

octoprint

OctoPrint API Error Messages vulnerable to XSS

octoprint

OctoPrint Incorrect Access Control

ec-cube/ec-cube

EC-CUBE Cross-site scripting vulnerability

hashicorp/vault-action

Vault GitHub Action did not correctly mask multi-line secrets in output

ctx

drupal/core, drupal/drupal

Drupal Core Open Redirect vulnerability

drupal/core, drupal/core, drupal/core, drupal/drupal, drupal/drupal, drupal/drupal

Drupal Core Access bypass vulnerability

drupal/core, drupal/core, drupal/core, drupal/core, drupal/drupal, drupal/drupal, drupal/drupal, drupal/drupal

Drupal Core Cross-site scripting vulnerability

drupal/core, drupal/core, drupal/core, drupal/drupal, drupal/drupal, drupal/drupal

Drupal Core Arbitrary PHP code execution vulnerability

jquery-query-object

jquery-plugin-query-object contains prototype pollution vulnerability

metasploit-framework

Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module

salt

Command Injection in SaltStack Salt

org.jenkins-ci.plugins:config-file-provider

Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs

org.jenkins-ci.plugins:config-file-provider

Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs

org.jenkins-ci.plugins:electricflow, org.jenkins-ci.plugins:electricflow

Missing permission check in Jenkins CloudBees CD Plugin allows scheduling builds

org.jenkins-ci.plugins:templating-engine

Remote code execution vulnerability in Jenkins Templating Engine Plugin

org.jenkins-ci.plugins:config-file-provider

XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin

org.jenkins-ci.plugins:config-file-provider

CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files

github.com/hashicorp/consul, github.com/hashicorp/consul, github.com/hashicorp/consul

HashiCorp Consul Cross-site Scripting vulnerability

dio

Duplicate Advisory: Improper Neutralization of CRLF Sequences in dio

lavalite/cms

Cross Site Scripting (XSS) in LavaLite 5.8.0

@azure/ms-rest-nodeauth

Improper Privilege Management in Azure ms-rest-nodeauth

github.com/mongodb/mongo-tools

MongoDB Tools Improper Certificate Validation vulnerability

wikimedia/parsoid, wikimedia/parsoid

Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS)

org.jenkins-ci.plugins:hp-application-automation-tools-plugin

SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin

org.jenkins-ci.plugins:hp-application-automation-tools-plugin

CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin

org.jenkins-ci.plugins:hp-application-automation-tools-plugin

Missing permission checks in Micro Focus Application Automation Tools Plugin

org.jenkins-ci.plugins:hp-application-automation-tools-plugin

Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin

intelliants/subrion

subrion CMS Cross Site Scripting (XSS) vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

View name validation bypass in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Lack of type validation in agent related REST API in Jenkins

org.jenkins-ci.plugins:promoted-builds

CSRF vulnerability in Jenkins promoted builds Plugin

docsify

Docsify vulnerable to cross-site scripting due to mishandled encoding

org.jvnet.hudson.plugins:jabber

Passwords stored in plain text by Jenkins Jabber (XMPP) notifier and control Plugin

org.jenkins-ci.plugins:dependency-track

Missing permission checks in Jenkins OWASP Dependency-Track Plugin allow capturing credentials

org.jenkins-ci.plugins:tfs

Missing permission check in Jenkins Team Foundation Server Plugin allows enumerating credentials IDs