Open Source Vulnerabilities

opencart/opencart

OpenCart Cross-Site Request Forgery (CSRF)

com.google.gerrit:gerrit-plugin-api, com.google.gerrit:gerrit-plugin-api, com.google.gerrit:gerrit-plugin-api, com.google.gerrit:gerrit-plugin-api, com.google.gerrit:gerrit-plugin-api, com.google.gerrit:gerrit-plugin-api

Information leak in Gerrit

com.microsoft.azure:azure-eventhubs, com.azure:azure-core-amqp

Azure SDK for Java Security Feature Bypass Vulnerability

org.wildfly:wildfly-parent, org.wildfly:wildfly-parent

Wildfly has a memory leak vulnerability

moodle/moodle

Moodle stored Cross-site Scripting (XSS)

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Cross-site Scripting (XSS)

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Denial of Service

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle incorrect access control

horizon, horizon, horizon, horizon

OpenStack Horizon Open redirect in workflow forms

snapcraft

snapcraft Access Restriction Bypass

cabot

Cabot Cross Site Scripting (XSS) vulnerability via Address column

ec-cube/ec-cube

EC-CUBE Improper Restriction of Rendered UI Layers or Frames

ec-cube/ec-cube

EC-CUBE Improper input validation vulnerability

keyget

keyget vulnerable to prototype pollution

io.jenkins.plugins:chaos-monkey

Missing permission checks in Jenkins Chaos Monkey Plugin

io.jenkins.plugin-management:plugin-management-parent-pom

Jenkins Plugin Installation Manager Tool did not verify plugin downloads

org.jenkins-ci.plugins:cvs

XXE vulnerability in Jenkins CVS Plugin

io.jenkins.plugins:chaos-monkey

Missing permission checks in Jenkins Chaos Monkey Plugin

org.jenkins-ci.plugins:shelve-project-plugin

CSRF vulnerability in Jenkins Shelve Project Plugin

blosc2

blosc2 heap-based buffer overflow

org.craftercms:crafter-core

XML injection in Crafter CMS

org.craftercms:crafter-core

Missing Authorization in Crafter CMS

org.craftercms:crafter-core

Cross site scripting in Crafter CMS

github.com/heketi/heketi

Heketi logs sensitive information

scikit-learn

scikit-learn Denial of Service

gitaly, gitaly, gitaly

Gitaly Insufficient Session Expiration vulnerability

wwbn/avideo

AVideo vulnerable to Improper Privilege Management

@strikeentco/set

Prototype pollution in @strikeentco/set

locust

Locust Stored Cross-site Scripting Vulnerability

ckeditor4

Improper Neutralization of Input During Web Page Generation in CKEditor4

magento/community-edition, magento/community-edition

Magento incorrect permissions vulnerability in the Inventory module

magento/community-edition, magento/community-edition

Magento information disclosure vulnerability

magento/community-edition, magento/project-community-edition

Magento 2 Community Edition RCE via Unsafe File Upload

magento/community-edition, magento/community-edition

Magento 2 Community Edition vulnerable to Improper Authorization

magento/community-edition, magento/community-edition

Magento SQL Injection vulnerability

magento/community-edition, magento/community-edition, magento/project-community-edition

Magento incorrect user permissions vulnerability within the Inventory component

magento/community-edition, magento/project-community-edition

Magento 2 Community Edition Incorrect Authorization

magento/community-edition, magento/community-edition, magento/project-community-edition

Magento incorrect permissions vulnerability in the Integrations component

microweber/microweber

Microweber Insufficient Session Expiry

intelliants/subrion

Subrion CMS CSRF Vulnerability

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt Command Injection in netapi ssh client

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi

salt, salt, salt, salt, salt, salt, salt, salt, salt

SaltStack Salt Allows creating certificates with weak file permissions

org.jvnet.hudson.plugins:findbugs

Stored XSS vulnerability in Jenkins FindBugs Plugin

org.jenkins-ci.plugins:mailcommander

Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin

org.jenkins-ci.plugins:labmanager

Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin

org.jenkins-ci.plugins:sqlplus-script-runner

Password written to the build log by Jenkins SQLPlus Script Runner Plugin

org.csanchez.jenkins.plugins:kubernetes, org.csanchez.jenkins.plugins:kubernetes, org.csanchez.jenkins.plugins:kubernetes, org.csanchez.jenkins.plugins:kubernetes

Missing Authorization in Jenkins Kubernetes Plugin

com.rapid7:jenkinsci-appspider-plugin

Password stored in plain text by Jenkins AppSpider Plugin

org.jenkins-ci.plugins:visualworks-store

XXE vulnerability in Jenkins Visualworks Store Plugin