Open Source Vulnerabilities

dolibarr/dolibarr

Dolibarr Stored Cross-site Scripting

org.wso2.am:am-parent

WSO2 API Manager vulnerable to SSRF

kerberos

Duplicate Advisory: Kerberos for NodeJS allows DLL Injection

misp-maltego

Maltego incorrectly shares a MISP connection across users in a remote-transform use case

scikit-learn

scikit-learn Deserialization of Untrusted Data

intelliants/subrion

Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability

intelliants/subrion

Subrion CMS XSS

nystudio107/craft-seomatic

SEOmatic for CraftCMS allows Server-Side Template Injection

org.keycloak:keycloak-core

Keycloak Insufficient Session Expiry

org.keycloak:keycloak-core

Keycloak leaks sensitive information in logged exceptions

org.opennms.core:org.opennms.core.daemon

OpenNMS Horizon RCE via Unsafe Deserialization

keystone, keystone

OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID

keystone, keystone

OpenStack Keystone does not check signature TTL of the EC2 credential auth method

keystone, keystone

OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context

dolibarr/dolibarr

Incorrect Authorization in Dolibarr

org.jenkins-ci.plugins:ec2

Lack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin

org.jenkins-ci.plugins:credentials-binding

Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps

io.jenkins.plugins:scm-filter-jervis

RCE vulnerability in SCM Filter Jervis Plugin

org.jenkins-ci.plugins:cvs

CSRF vulnerability in Jenkins CVS Plugin

org.jenkins-ci.plugins:credentials-binding

Improper masking of some secrets in Jenkins Credentials Binding Plugin

org.jenkins-ci.plugins:ec2

Missing SSH host key validation in Jenkins Amazon EC2 Plugin

org.jenkins-ci.plugins:ec2

Users with Overall/Read access can enumerate credentials IDs in Amazon EC2 Plugin

org.jenkins-ci.plugins:copyartifact

Improper permission checks in Jenkins Copy Artifact Plugin

org.jenkins-ci.plugins:ec2

CSRF vulnerability in Amazon EC2 Plugin

grin

Grin allows attackers to adversely affect availability of data on a Mimblewimble blockchain

org.keycloak:keycloak-core

Keycloak users may be able to remove MFA from other users' devices

chrome-launcher

chrome-launcher subject to OS Command Injection

nilsteampassnet/teampass

TeamPass PHP arbitrary file include vulnerability

nilsteampassnet/teampass

TeamPass files are available without authentication

salt, salt

SaltStack Salt Unauthenticated Remote Code Execution

salt, salt

SaltStack Salt is vulnerable Arbitrary Directory Access

github.com/grafana/grafana

Grafana information disclosure

intelliants/subrion

Subrion CMS CSV injection via Export Language

intelliants/subrion

Subrion CMS PHP Object Injection

github.com/grafana/grafana

Grafana world readable configuration files

io.undertow:undertow-core

Improper Authorization in Undertoe

github.com/grafana/grafana

Grafana XSS in header column rename

io.undertow:undertow-core

Improper Input Validation in Undertow

storefront-api, vue-storefront-api

Diavante vue-storefront-api and storefront-api disclose stack trace

com.parasoft:parasoft-findings

XXE vulnerability in Jenkins Parasoft Findings Plugin

org.fedoraproject.jenkins.plugins:copr

Credentials stored in plain text by Jenkins Copr Plugin

io.jenkins.plugins:aws-sam

RCE vulnerability in Jenkins AWS SAM Plugin

org.jenkins-ci.plugins:yaml-axis

RCE vulnerability in Jenkins Yaml Axis Plugin

dolibarr/dolibarr

Dolibarr Cross-Site Request Forgery Vulnerability

dolibarr/dolibarr

Dolibarr stored Cross-site Scripting vulnerability

silverstripe/framework, silverstripe/userforms, silverstripe/assets, silverstripe/assets

SilverStripe Folders migrated from 3.x may be unsafe to upload to

Microsoft.ChakraCore

ChakraCore Remote Code Execution Vulnerability