Open Source Vulnerabilities

mediawiki/core, mediawiki/core

MediaWiki Special:UserRights exposes the existence of hidden users

mediawiki/core, mediawiki/core, mediawiki/core

MediaWiki Cross-site Scripting (XSS) vulnerability

mediawiki/core, mediawiki/core

MediaWiki Cross-site Scripting (XSS) vulnerability

com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.dxp.bom, com.liferay.portal:release.dxp.bom, com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom, com.liferay.portal:com.liferay.portal.impl

Liferay Portal and Liferay DXP Bypass via Double Encoded URL

org.jenkins-ci.plugins:liquibase-runner

XXE vulnerability in Jenkins Liquibase Runner Plugin

org.6wind.jenkins:lockable-resources

CSRF vulnerability in Jenkins Lockable Resources Plugin

org.jvnet.hudson.plugins:warnings

CSRF vulnerability in Jenkins warnings Plugin allows remote code execution

org.jenkins-ci.plugins:liquibase-runner

Missing permission check in Jenkins Liquibase Runner Plugin allows enumerating credentials IDs

org.jenkins-ci.plugins:implied-labels

Missing permission check in Jenkins Implied Labels Plugin allows reconfiguring the plugin

org.jenkins-ci.plugins:liquibase-runner

Stored XSS vulnerability in Jenkins Liquibase Runner Plugin

org.jenkins-ci.plugins:script-security, org.jenkins-ci.plugins:script-security

Sandbox bypass vulnerability in Jenkins Script Security Plugin

cabot

Cabot Cross Site Scripting (XSS) vulnerability via Endpoint column

devgroup/dotplant

DotPlant2 Improper Restriction of XML External Entity Reference

org.jvnet.hudson.plugins:storable-configs-plugin

Arbitrary file write vulnerability in Jenkins Storable Configs Plugin

org.jenkins-ci.plugins:elastest

Passwords stored in plain text by ElasTest Plugin

org.jenkins-ci.plugins:elastest

Missing permission checks in Jenkins ElasTest Plugin

org.jvnet.hudson.plugins:copy-data-to-workspace-plugin

Arbitrary file read vulnerability in Copy data to workspace Jenkins Plugin

org.jenkins-ci.plugins:elastest

CSRF vulnerability in Jenkins ElasTest Plugin

org.jvnet.hudson.plugins:selection-tasks-plugin

System command execution vulnerability in Selection tasks Jenkins Plugin

org.jvnet.hudson.plugins:storable-configs-plugin

Arbitrary file read vulnerability in Jenkins Storable Configs Plugin

org.jenkins-ci.plugins:custom-job-icon

Stored XSS vulnerability in Custom Job Icon Plugin

org.jenkins-ci.plugins:description-column-plugin

Stored XSS vulnerability in Description Column Plugin

io.jenkins.plugins:perfecto

OS command execution vulnerability in Perfecto Plugin

org.jenkins-ci.plugins:chosen-views-tabbar

Stored XSS vulnerability in chosen-views-tabbar Plugin

org.jvnet.hudson.plugins:clearcase-release

Stored XSS vulnerability in ClearCase Release Plugin

io.jenkins.plugins:perfecto

Missing permission check in Perfecto Plugin

org.jvnet.hudson.plugins:locked-files-report

Stored XSS vulnerability in Locked Files Report Plugin

org.jenkins-ci.plugins:mongodb

Missing permission checks in MongoDB Plugin

org.jenkins-ci.plugins:covcomplplot

Stored XSS vulnerability in Coverage/Complexity Scatter Plot Plugin

org.jenkins-ci.plugins:mongodb

CSRF vulnerability in MongoDB Plugin

io.jenkins.blueocean:blueocean

Missing permission check in Blue Ocean Plugin

jenkins.ci.plugins.computerqueue:computer-queue-plugin

Stored XSS vulnerability in computer-queue-plugin Plugin

org.jvnet.hudson.plugins:android-lint

Stored XSS vulnerability in android-lint Plugin

org.jenkins-ci.plugins:mailer, org.jenkins-ci.plugins:mailer, org.jenkins-ci.plugins:mailer

Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin

org.jenkins-ci.plugins:radiatorviewplugin

Stored XSS vulnerability in Radiator View Plugin

org.jenkins-ci.plugins:cloudbees-jenkins-advisor

Incorrect permission check in Health Advisor by CloudBees Plugin

org.jenkins-ci.plugins:validating-string-parameter

Stored XSS vulnerability in Validating String Parameter Plugin

org.jenkins-ci.plugins:pipeline-maven

Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name

io.jenkins.blueocean:blueocean

Path traversal vulnerability in Blue Ocean Plugin

org.jenkins-ci.plugins:email-ext

Missing hostname validation in Email Extension Plugin

compu-brotli-sys, Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm64, Microsoft.NETCore.App.Runtime.linux-x64, Microsoft.NETCore.App.Runtime.osx-x64, Microsoft.NETCore.App.Runtime.win-arm, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64, Microsoft.NETCore.App.Runtime.Mono.linux-arm, Microsoft.NETCore.App.Runtime.Mono.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64, Microsoft.NETCore.App.Runtime.Mono.linux-x64, Microsoft.NETCore.App.Runtime.Mono.osx-x64, Microsoft.NETCore.App.Runtime.browser-wasm, Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm, Microsoft.NETCore.App.Runtime.linux-musl-arm64, Microsoft.NETCore.App.Runtime.linux-musl-x64, Microsoft.NETCore.App.Runtime.linux-x64, Microsoft.NETCore.App.Runtime.osx-x64, Microsoft.NETCore.App.Runtime.win-arm, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86, Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm, Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64, Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64, Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86, Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasm, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasm, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64, Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm, Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64, Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64, Microsoft.NETCore.App.Runtime.Mono.android-arm, Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.android-arm64, Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.android-x64, Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.android-x86, Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.browser-wasm, Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.ios-arm, Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.ios-arm64, Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64, Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64, Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86, Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.linux-arm, Microsoft.NETCore.App.Runtime.Mono.linux-arm64, Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64, Microsoft.NETCore.App.Runtime.Mono.linux-x64, Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64, Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64, Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.osx-arm64, Microsoft.NETCore.App.Runtime.Mono.osx-x64, Microsoft.NETCore.App.Runtime.Mono.tvos-arm64, Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64, Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64, Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64, Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64, Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86, Microsoft.NETCore.App.Runtime.Mono.win-x64, Microsoft.NETCore.App.Runtime.Mono.win-x86, Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm, Microsoft.NETCore.App.Runtime.linux-musl-arm64, Microsoft.NETCore.App.Runtime.linux-musl-x64, Microsoft.NETCore.App.Runtime.linux-x64, Microsoft.NETCore.App.Runtime.osx-arm64, Microsoft.NETCore.App.Runtime.osx-x64, Microsoft.NETCore.App.Runtime.win-arm, Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86, brotli

Integer overflow in the bundled Brotli C library

zoujingli/thinkadmin

ThinkAdmin directory traversal vulnerability

org.apache.struts:struts2-core

Improper Preservation of Permissions in Apache Struts

Microsoft.AspNetCore.Http, Microsoft.AspNetCore.App, Microsoft.Owin, Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-x64, Microsoft.AspNetCore.App.Runtime.linux-x64, Microsoft.AspNetCore.App.Runtime.osx-x64, Microsoft.AspNetCore.App.Runtime.win-arm, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86, Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, Microsoft.AspNetCore.App.Runtime.win-arm64

Cookie parsing failure

hermes-engine

Signed to Unsigned Conversion Error in Facebook Hermes

hermes-engine

Out-of-bounds Read and Out-of-bounds Write in Facebook Hermes

illuminate/database, illuminate/database, illuminate/database

Guard bypass in Eloquent models affecting Laravel illuminate database component

hermes-engine

Access of Resource Using Incompatible Type in Facebook Hermes

silverstripe-australia/advancedreports

silverstripe-advancedreports vulnerable to XSS

com.xuxueli:xxl-job

xxl-job Multiple cross-site scripting (XSS) vulnerabilities