Open Source Vulnerabilities

UmbracoCMS.Core

Umbraco CMS Authenticated File Upload

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

dolibarr/dolibarr

Dolibarr ERP and CRM SQLi

dolibarr/dolibarr

Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php

dot

Improper Control of Generation of Code in doT

manila, manila, manila

OpenStack Manila Unprivileged users can retrieve, use and manipulate share networks

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

blamer

Improper Neutralization of Special Elements used in an OS Command in Blamer

bcosca/fatfree

Fat-Free Framework arbitrary code execution

phpbb/phpbb

phpBB Cross-Site Request Forgery (CSRF)

org.jenkins-ci.plugins:literate

Remote Code Execution vulnerability in Jenkins Literate Plugin

io.jenkins.plugins:cryptomove

OS command injection in CryptoMove Plugin

org.jenkins-ci.plugins:skytap

Credentials transmitted in plain text by Skytap Cloud CI Plugin

fr.edf.jenkins.plugins:mac

Missing permission checks in Mac Plugin

org.jenkins-ci.plugins:openshift-deployer

Credentials transmitted in plain text by OpenShift Deployer Plugin

com.openmake:deployhub

Credentials transmitted in plain text by Jenkins DeployHub Plugin

org.jenkins-ci.plugins:zephyr-for-jira-test-management

Jenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text

org.jenkins-ci.plugins:backlog

Credentials transmitted in plain text by Backlog Plugin

fr.edf.jenkins.plugins:mac

Missing SSH host key validation in Mac Plugin

org.jvnet.hudson.plugins:svn-release-mgr

Jenkins Subversion Release Manager Plugin vulnerable to cross-site scripting (XSS)

org.jenkins-ci.plugins:repository-connector

Credentials transmitted in plain text by Repository Connector Plugin

org.jenkins-ci.plugins:logstash

Credentials transmitted in plain text by Jenkins Logstash Plugin

org.jenkins-ci.plugins:rundeck

XXE vulnerability in Rundeck Plugin

org.jenkins-ci.plugins:sonar-quality-gates

Jenkins Sonar Quality Gates Plugin transmits credentials in plain text during configuration

org.jenkins-ci.plugins:p4

Missing permission checks in Jenkins P4 Plugin

org.jenkins-ci.plugins:quality-gates

Jenkins Quality Gates Plugin transmits credentials in plain text during configuration

fr.edf.jenkins.plugins:mac

CSRF vulnerability in Mac Plugin

org.jenkins-ci.plugins:p4

CSRF vulnerability in Jenkins P4 Plugin

org.jenkins-ci.plugins:cobertura

XXE vulnerability in Jenkins Cobertura Plugin

org.jenkins-ci.plugins:zephyr-enterprise-test-management

Credentials stored in plain text by Zephyr Enterprise Test Management Plugin

org.jenkins-ci.plugins:git

Improper Neutralization of Input During Web Page Generation in Jenkins Git Plugin

org.jenkins-ci.plugins:timestamper

Stored XSS vulnerability in Jenkins Timestamper Plugin

org.jenkins-ci.plugins:audit-trail

XSS vulnerability in Jenkins Audit Trail Plugin

org.jenkins-ci.plugins:script-security

Sandbox bypass vulnerability in Script Security Plugin

org.jenkins-ci.plugins:cobertura

Arbitrary file write vulnerability in Jenkins Cobertura Plugin

org.jenkins-ci.plugins:script-security

Sandbox bypass vulnerability in Script Security Plugin

froxlor/froxlor

Froxlor Information Disclosure

froxlor/froxlor

Froxlor Exposure of Sensitive Information to an Unauthorized Actor

froxlor/froxlor

Froxlor arbitrary code execution via the database configuration options

backdoor in phpass version 0.3.x-dev, 0.3.x

nystudio107/craft-seomatic

SEOmatic for CraftCMS allows Server-Side Template Injection

org.apache.struts:struts2-core

Cross-site Scripting in Apache Struts

cardgate/woocommerce

CardGate Payments plugin for WooCommerce does not validate request origin

DotNetNuke.Core

DNN Path Traversal via Zip Slip

DotNetNuke.Core

DNN File Upload Vulnerability

DotNetNuke.Core

DNN XSS Vulnerability

org.jyaml:jyaml

Deserialization of Untrusted Data in JYaml

silverstripe/framework, silverstripe/framework

SilverStripe Denial of Service on flush and development URL tools