Open Source Vulnerabilities

silverstripe/graphql, silverstripe/graphql

Silverstripe CSRF Protection Bypass via GraphQL

nova, nova, nova

OpenStack Nova can leak consoleauth token into log files

component-flatten

component-flatten vulnerable to Prototype Pollution

promise-probe

promise-probe OS command injection vulnerability

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

com.applatix.jenkins:applatix

Password stored in plain text by Applatix Plugin

org.jenkins-ci.plugins:harvest

Passwords stored in plain text by Harvest SCM Plugin

org.jenkins-ci.plugins:harvest

Passwords stored in plain text by Harvest SCM Plugin

RPD:bmc-rpd

Credential stored in plain text by BMC Release Package and Deployment Plugin

ru.yandex.jenkins.plugins.debuilder:debian-package-builder

Credentials stored in plain text by debian-package-builder Plugin

com.catalogic.ecxjenkins:catalogic-ecx

Password stored in plain text by ECX Copy Data Management Plugin

org.jenkins-ci.plugins:radargun

RCE vulnerability in RadarGun Plugin

org.jenkins-ci.plugins:brakeman

Stored XSS vulnerability in Jenkins brakeman Plugin

com.dubture.jenkins:digitalocean-plugin

Token stored in plain text by DigitalOcean Plugin

org.jenkins-ci.plugins:fitnesse

XXE vulnerability in FitNesse Plugin

com.parasoft:environment-manager

Password stored in plain text by Parasoft Environment Manager Plugin

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter

Password stored in plain text by Dynamic Extended Choice Parameter Plugin

com.mobileenerlytics.eagle.tester:eagle-tester

Plaintext Storage of a Password in Jenkins Eagle Tester Plugin

org.jenkins-ci.plugins:google-kubernetes-engine

RCE vulnerability in Google Kubernetes Engine Plugin

org.jenkins-ci.plugins:pipeline-build-step

Users with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin

org.jenkins-ci.plugins.workflow:workflow-cps

Improper Input Validation in Jenkins Pipeline: Groovy Plugin

org.jenkins-ci.plugins:s3

Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration

org.jenkins-ci.tools:git-parameter

Jenkins Git Parameter Plugin vulnerable to stored cross-site scripting (XSS)

org.jenkins-ci.tools:git-parameter

Jenkins Git Parameter Plugin vulnerable to Stored cross-site scripting (XSS)

org.jenkins-ci.plugins:pipeline-githubnotify-step

CSRF vulnerability in Pipeline GitHub Notify Step Plugin allows capturing credentials

org.jenkins-ci.plugins:azure-ad

Client secret transmitted in plain text by Azure AD Plugin

org.jenkins-ci.plugins:subversion

Subversion Plugin stored XSS vulnerability

org.jenkins-ci.plugins:pipeline-githubnotify-step

Missing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials

org.jenkins-ci.plugins:nunit

XXE vulnerability in NUnit Plugin

org.jenkins-ci.plugins:script-security

Improper Input Validation in Jenkins Script Security Plugin

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

github.com/containers/podman, github.com/containers/podman/v2

Podman has Files or Directories Accessible to External Parties

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

omniauth-weibo-oauth2

omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party

magento/community-edition, magento/community-edition

Magento Path Traversal

magento/community-edition, magento/community-edition

Magento deserialization vulnerability

magento/community-edition, magento/community-edition, magento/core

Magento stored cross-site scripting vulnerability

magento/community-edition, magento/community-edition, magneto/core

Magento stored cross-site scripting vulnerability

magento/community-edition, magento/community-edition, magento/core

Magento sql injection vulnerability

magento/community-edition, magento/community-edition, magneto/core

Magento security bypass vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins REST APIs vulnerable to clickjacking

org.jenkins-ci.plugins:websphere-deployer

XXE vulnerability in Jenkins WebSphere Deployer Plugin

io.jenkins.plugins:code-coverage-api

Stored XSS vulnerability in Code Coverage API Plugin

org.jenkins-ci.plugins:fortify

Fortify Plugin stored credentials in plain text

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Diagnostic page exposed session cookies

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins vulnerable to UDP amplification reflection attack

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Non-constant time HMAC comparison