Open Source Vulnerabilities

org.jenkins-ci.plugins:vncviewer

Reflected XSS vulnerability in Jenkins VncViewer Plugin

org.jenkins-ci.plugins:StashBranchParameter

Passwords transmitted in plain text by Jenkins Stash Branch Parameter Plugin

io.jenkins.plugins:github-coverage-reporter

Secret stored in plain text by Jenkins GitHub Coverage Reporter Plugin

org.jenkins-ci.plugins:slack-uploader

Secret stored in plain text by Jenkins Slack Upload Plugin

com.elasticbox.jenkins-ci.plugins:kubernetes-ci

RCE vulnerability in ElasticBox Jenkins Kubernetes CI/CD Plugin

org.jenkins-ci.plugins:fortify-on-demand-uploader

Missing permission checks in Jenkins Fortify on Demand Plugin

org.jenkins-ci.plugins:vncrecorder

Reflected XSS vulnerability in Jenkins VncRecorder Plugin

org.jenkins-ci.plugins:sonargraph-integration

Stored XSS vulnerability in Jenkins Sonargraph Integration Plugin

org.jenkins-ci.plugins:fortify-on-demand-uploader

Users with Overall/Read access could enumerate credentials IDs in Jenkins Fortify on Demand Plugin

org.jenkins-ci.plugins:fortify-on-demand-uploader

CSRF vulnerability in Jenkins Fortify on Demand Plugin

org.jenkins-ci.plugins:vncrecorder

Stored XSS vulnerability in Jenkins VncRecorder Plugin

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento business logic error vulnerability

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento security mitigation bypass vulnerability

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento security mitigation bypass vulnerability

magento/community-edition, magento/community-edition, magento/core

Magento defense-in-depth security mitigation vulnerability

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento Stored cross-site scripting

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento Defense-in-depth security mitigation vulnerability

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento authorization bypass vulnerability

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento command injection vulnerability

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento command injection vulnerability

magento/community-edition, magento/core, magento/project-community-edition

Magento Signature verification bypass

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento stored cross-site scripting vulnerability

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento command injection vulnerability

magento/community-edition, magento/core, magento/project-community-edition

Magento stored cross-site scripting vulnerability

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento command injection vulnerability

magento/community-edition, magento/community-edition, magento/core, magento/project-community-edition

Magento Security mitigation bypass vulnerability

magento/community-edition, magento/community-edition, magento/core

Magento Security mitigation bypass vulnerability

org.apache.activemq:artemis-commons

ActiveMQ Artemis has Insufficiently Protected Credentials

mediawiki/core, mediawiki/core, mediawiki/core

img_auth.php may leak private extension images into the public cache

traceroute

Node-Traceroute RCE Vulnerability

GleamTech.FileUltimate

GleamTech FileUltimate Cross-site Scripting

airesvsg/acf-to-rest-api

acf-to-rest-api plugin insecure direct object reference (IDOR) via permalink manipulation

nukeviet/nukeviet

NukeViet Cross-Site Request Forgery (CSRF)

nukeviet/nukeviet

NukeViet Cross-Site Request Forgery (CSRF)

nukeviet/nukeviet

NukeViet Cross-Site Request Forgery (CSRF)

org.wildfly:wildfly-parent

Wildfly Unsafe Deserialization Vulnerability

ec-cube/ec-cube, ec-cube/ec-cube

EC-CUBE Directory traversal vulnerability

dolibarr/dolibarr

Dolibarr reflected cross-site scripting (XSS) vulnerability

github.com/mattermost/mattermost-server/v5

Mattermost Server Sensitive Data Exposure

strapi

Improper Input Validation in strapi

rtslib-fb

rtslib-fb weak permissions for /etc/target/saveconfig.json file

woocommerce/woocommerce

WooCommerce Cross-Site Request Forgery (CSRF)

github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command

github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server

Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations

github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server

Mattermost Server does not restrict SAML certificate path for System Administrators

github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server

Mattermost Server has X.509 Improper Certificate Validation

github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server

Mattermost Server has Improper Authorization for Integration Requests

github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server

Mattermost Server server restarts may provide attackers with API access

github.com/mattermost/mattermost-server

Mattermost Server allows an attacker to specify a full pathname of a log file

github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server

Mattermost Server exposes team invite IDs through API endpoints