Open Source Vulnerabilities

org.jenkins-ci.plugins:tfs

CSRF vulnerability in Jenkins Team Foundation Server Plugin allow capturing credentials

org.jenkins-ci.plugins:tfs

Missing permission check in Jenkins Team Foundation Server Plugin allow capturing credentials

org.jenkins-ci.plugins:cloud-stats

Missing permission check in Jenkins Cloud Statistics Plugin

io.jenkins.plugins:rest-list-parameter

Stored XSS vulnerability in Jenkins REST List Parameter Plugin

org.jenkins-ci.plugins:dependency-track

CSRF vulnerability and in Jenkins OWASP Dependency-Track Plugin allow capturing credentials

org.jenkins-ci.plugins:build-with-parameters

Stored XSS vulnerability in Jenkins Build With Parameters Plugin

org.jenkins-ci.plugins:extra-columns

Stored XSS vulnerability in Jenkins Extra Columns Plugin

org.jenkins-ci.plugins:build-with-parameters

CSRF vulnerability in Jenkins Build With Parameters Plugin

craftcms/cms

Craft CMS Cross-site Scripting Vulnerability

zencart/zencart

Reflected XSS in Zen Cart before 1.5.7a

concrete5/concrete5

Concrete CMS Cross-site Scripting via Survey Blocks

org.jenkins-ci.plugins:role-strategy

Incorrect permission checks in Jenkins Role-based Authorization Strategy Plugin may allow accessing some items

org.jenkins-ci.plugins:libvirt-slave

CSRF vulnerability in Jenkins Libvirt Agents Plugin

org.jenkins-ci.plugins:aws-credentials

Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs

io.jenkins.plugins:warnings-ng

Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents

org.jenkins-ci.plugins:matrix-auth

Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items

st2client

StackStorm st2 Infinite Loop Condition

aimeos/aimeos-typo3, aimeos/aimeos-typo3

Aimeos Typo3 extension contains Cross-site Scripting vulnerability

io.fabric8:kubernetes-client, io.fabric8:kubernetes-client, io.fabric8:kubernetes-client, io.fabric8:kubernetes-client

Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Missing permission check in Moodle

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Bypass email verification secret when confirming account registration

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle contains Stored XSS via ID number user profile field

shopxo/shopxo

ShopXO RCE Vulnerability

getgrav/grav, getgrav/grav

Grav CMS Local File Injection

getgrav/grav, getgrav/grav

Grav CMS Cross-Site Request Forgery (CSRF)

getgrav/grav, getgrav/grav

Grav CMS Arbitrary File Deletion

diesel

Fix a use-after-free bug in diesels Sqlite backend

changeset

Changeset vulnerable to prototype pollution

org.keycloak:keycloak-core

Keycloak discloses information without authentication

scratchpad

move_elements can double-free objects on panic

bam

Loading a bgzip block can write out of bounds if size overflows.

github.com/rancher/rancher, github.com/rancher/rancher, github.com/rancher/rancher

Rancher Cross-site Scripting Vulnerability

qcubed/qcubed

qcubed PHP object injection

qcubed/qcubed

qcubed reflected cross-site scripting (XSS) vulnerability

qcubed/qcubed

qcubed SQL injection vulnerability in profile.php via the strQuery parameter

salt

Saltstack Salt Unauthenticated Arbitrary Code Execution

zoujingli/thinkadmin

ThinkAdmin Admin Panel Access using Default Credentials

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt eauth tokens can be used once after expiration

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt is vulnerable to shell injection via ProxyCommand argument

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt command injection in the Salt-API when using the Salt-SSH client

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt Improper Authentication vulnerability

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt Server Side Template Injection

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt Directory Traversal vulnerability

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt Improper Certificate Validation

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt Improper SSL Certificate Validation

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt command injection via a crafted process name

vscode-npm-script

Remote code execution in vscode-npm-script

System.Drawing.Common, System.Drawing.Common

.NET Core Remote Code Execution Vulnerability

Microsoft.NETCore.App, Microsoft.NETCore.App.Host.linux-arm, Microsoft.NETCore.App.Host.linux-arm64, Microsoft.NETCore.App.Host.linux-musl-arm64, Microsoft.NETCore.App.Host.linux-musl-x64, Microsoft.NETCore.App.Host.linux-x64, Microsoft.NETCore.App.Host.osx-x64, Microsoft.NETCore.App.Host.rhel.6-x64, Microsoft.NETCore.App.Host.win-arm, Microsoft.NETCore.App.Host.win-arm64, Microsoft.NETCore.App.Host.win-x64, Microsoft.NETCore.App.Host.win-x86, Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm64, Microsoft.NETCore.App.Runtime.linux-musl-x64, Microsoft.NETCore.App.Runtime.linux-x64, Microsoft.NETCore.App.Runtime.osx-x64, Microsoft.NETCore.App.Runtime.rhel.6-x64, Microsoft.NETCore.App.Runtime.win-arm, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64, Microsoft.NETCore.App.Runtime.Mono.linux-arm, Microsoft.NETCore.App.Runtime.Mono.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64, Microsoft.NETCore.App.Runtime.Mono.linux-x64, Microsoft.NETCore.App.Runtime.Mono.osx-x64, Microsoft.NETCore.App.Runtime.android-arm, Microsoft.NETCore.App.Runtime.android-arm64, Microsoft.NETCore.App.Runtime.android-x64, Microsoft.NETCore.App.Runtime.android-x86, Microsoft.NETCore.App.Runtime.browser-wasm, Microsoft.NETCore.App.Runtime.ios-arm, Microsoft.NETCore.App.Runtime.ios-x64, Microsoft.NETCore.App.Runtime.ios-x86, Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm, Microsoft.NETCore.App.Runtime.linux-musl-arm64, Microsoft.NETCore.App.Runtime.linux-musl-x64, Microsoft.NETCore.App.Runtime.linux-x64, Microsoft.NETCore.App.Runtime.osx-x64, Microsoft.NETCore.App.Runtime.tvos-arm64, Microsoft.NETCore.App.Runtime.tvos-x64, Microsoft.NETCore.App.Runtime.win-arm, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86

Denial of service in .NET core