Open Source Vulnerabilities

org.jenkins-ci.plugins:ansible

Missing permission checks in Jenkins Ansible Plugin allow enumerating credentials IDs

io.jenkins.plugins:aws-global-configuration

Missing permission check in Jenkins AWS Global Configuration Plugin allows replacing plugin configuration

org.jvnet.hudson.plugins:analysis-core

Stored XSS vulnerability in Jenkins Static Analysis Utilities Plugin

org.csanchez.jenkins.plugins:kubernetes, org.csanchez.jenkins.plugins:kubernetes, org.csanchez.jenkins.plugins:kubernetes, org.csanchez.jenkins.plugins:kubernetes

Missing authorization in Jenkins Kubernetes Plugin

org.jenkins-ci.plugins:azure-keyvault

Missing permission checks in Jenkins Azure Key Vault Plugin allow enumerating credentials IDs

org.jenkins-ci.plugins:mercurial, org.jenkins-ci.plugins:mercurial, org.jenkins-ci.plugins:mercurial, org.jenkins-ci.plugins:mercurial

XXE vulnerability in Jenkins Mercurial Plugin

org.jenkins-ci.plugins:mercurial, org.jenkins-ci.plugins:mercurial, org.jenkins-ci.plugins:mercurial, org.jenkins-ci.plugins:mercurial

Missing Authorization in Jenkins Mercurial Plugin

org.jenkins-ci.plugins:subversion

XXE vulnerability in Jenkins Subversion Plugin

org.jenkins-ci.plugins:active-directory, org.jenkins-ci.plugins:active-directory

Improper Authentication in Jenkins Active Directory Plugin

org.jenkins-ci.plugins:active-directory

Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page

org.jenkins-ci.plugins:active-directory

CSRF vulnerability in Jenkins Active Directory Plugin

org.jenkins-ci.plugins:active-directory, org.jenkins-ci.plugins:active-directory

Improper Authentication (empty password) in Jenkins Active Directory Plugin

org.jenkins-ci.plugins:active-directory, org.jenkins-ci.plugins:active-directory

Authentication cache in Active Directory Jenkins Plugin allows logging in with any password

org.csanchez.jenkins.plugins:kubernetes, org.csanchez.jenkins.plugins:kubernetes, org.csanchez.jenkins.plugins:kubernetes, org.csanchez.jenkins.plugins:kubernetes

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin

ssddanbrown/bookstack

Bookstack Cross-site Scripting vulnerability

org.wildfly:wildfly-dist

Uncontrolled Resource Consumption in WildFly

aptdaemon

aptdaemon Information Disclosure via Improper Input Validation in Transaction class

github.com/grafana/grafana

Grafana XSS via a query alias for the ElasticSearch datasource

github.com/gophish/gophish

Gophish vulnerable to Server-Side Request Forgery

red-discordbot

Duplicate Advisory: Unauthorized privilege escalation in Mod module

yourls/yourls

YOURLS Stored Cross Site Scripting (XSS)

hermes-engine

Out-of-bounds Read in Facebook Hermes

io.fabric8:fabric8-maven-plugin

fabric8-maven-plugin: insecure way to construct Yaml Object leading to remote code execution

magento/community-edition

Magento 2 Community Edition XSS Vulnerability

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin Cross-site Scripting (XSS)

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin SQL injection vulnerability

com.barchart.jenkins:maven-release-cascade

CSRF vulnerability in Jenkins Maven Cascade Release Plugin

org.jenkins-ci.plugins:nerrvana-plugin

XXE vulnerability in Jenkins Nerrvana Plugin

com.hoiio.jenkins:sms

Access token stored in plain text by Jenkins SMS Notification Plugin

pyrocms/pyrocms

PyroCMS Vulnerable to CSRF

pyrocms/pyrocms

PyroCMS Vulnerable to CSRF

com.barchart.jenkins:maven-release-cascade

Missing permission checks in Jenkins Maven Cascade Release Plugin

org.jenkins-ci.plugins:release

Stored XSS vulnerability in Jenkins Release Plugin

org.biouno:uno-choice

Stored XSS vulnerability in Jenkins Active Choices Plugin

org.jenkins-ci.plugins:couchdb-statistics

Password stored in plain text by Jenkins couchdb-statistics Plugin

org.jenkins-ci.plugins:role-strategy

Improper authorization due to caching in Jenkins Role-based Authorization Strategy Plugin

org.jenkins-ci.plugins:shared-objects

CSRF vulnerability in Jenkins Shared Objects Plugin

hermes-engine

Always-Incorrect Control Flow Implementation in Facebook Hermes

org.jenkins-ci.plugins:persona

Arbitrary file read vulnerability in Jenkins Persona Plugin

org.jenkins-ci.plugins:audit-trail

Incorrect default pattern in Jenkins Audit Trail Plugin

org.biouno:uno-choice

Stored XSS vulnerability in Jenkins Active Choices Plugin

webrick, webrick, webrick

WEBRick vulnerable to HTTP Request/Response Smuggling

org.wildfly.openssl:wildfly-openssl-natives-parent

Wildfly-OpenSSL memory leak flaw

froala/wysiwyg-editor

Froala WYSIWYG Editor XSS Vulnerability

mantisbt/mantisbt

MantisBT unauthorized users able to access private files

mantisbt/mantisbt

MantisBT HTML Injection vulnerability

mantisbt/mantisbt

MantisBT XXS where a Custom Field with a crafted Regular Expression property is used

mediawiki/core, mediawiki/core

OATHAuth extension in MediaWiki is not implementing rate limit

mediawiki/core, mediawiki/core

MediaWiki Cross-site Scripting (XSS) vulnerability

mediawiki/core, mediawiki/core, mediawiki/core

MediaWiki Cross-site Scripting (XSS) vulnerability