Open Source Vulnerabilities

swagger-ui

Improper Neutralization of Input During Web Page Generation in swagger-ui

github.com/apple/swift-nio-ssl

SwiftNIO SSL arbitrary code execution vulnerability

github.com/sylabs/singularity

Singularity insecure permissions

tree-kill

Treekill Enables OS Command Injection

tree-kill

Duplicate Advisory: tree-kill vulnerable to remote code execution

typo3/cms, typo3/cms, typo3/cms, typo3/cms-core, typo3/cms-core, typo3/cms-core

TYPO3 SQL Injection in low-level Query Generator

typo3/cms-core, typo3/cms-core, typo3/cms-core, typo3/cms, typo3/cms, typo3/cms

TYPO3 Directory Traversal on ZIP extraction

typo3/cms-core, typo3/cms-core, typo3/cms-core, typo3/cms, typo3/cms, typo3/cms

TYPO3 Insecure Deserialization in Query Generator & Query View

org.jenkins-ci.plugins:weibo

Jenkins Weibo Plugin stores credentials unencrypted in its global configuration file

io.alauda.jenkins.plugins:alauda-kubernetes-support

Cross-Site Request Forgery in Jenkins Alauda Kubernetes Suport Plugin

io.alauda.jenkins.plugins:alauda-kubernetes-support

Improper Authorization in Jenkins Alauda Kubernetes Suport Plugin

com.alauda.jenkins.plugins:alauda-devops-pipeline

Jenkins Alauda DevOps Pipeline Plugin allows attackers with Overall/Read permission to capture credentials stored in Jenkins

org.jenkins-ci.plugins:rapiddeploy-jenkins

Jenkins RapidDeploy Plugin Cross-Site Request Forgery plugin

tech.andrey.jenkins:mission-control-view

Cross site scripting in Jenkins Mission Control Plugin

org.jenkins-ci.plugins:teamconcert

Jenkins Team Concert Plugin missing permission check

com.paul8620.jenkins.plugins:pipeline-aggregator-view

Jenkins Pipeline Aggregator View Plugin stored XSS vulnerability

org.jenkins-ci.plugins:rapiddeploy-jenkins

Jenkins RapidDeploy Plugin missing permission check

com.alauda.jenkins.plugins:alauda-devops-pipeline

Jenkins Alauda DevOps Pipeline Plugin vulnerable to cross-site request forgery

hudson.plugins.sctmexecutor:SCTMExecutor

Jenkins SCTMExecutor Plugin stores credentials in plain text

org.jenkins-ci.plugins:teamconcert

Jenkins Team Concert Plugin missing permission check

org.jenkins-ci.plugins:mantis

CSRF vulnerability in Jenkins Mantis Plugin

com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

Inefficient Regular Expression Complexity in Jenkins Build Failure Analyzer Plugin

com.inflectra.spiratest.plugins:inflectra-spira-integration

Improper Certificate Validation in Jenkins Spira Importer Plugin

org.jenkins-ci.plugins:websphere-deployer

SSL/TLS certificate validation globally and unconditionally disabled by Jenkins WebSphere Deployer Plugin

org.jenkins-ci.plugins:buildgraph-view

Jenkins buildgraph-view Plugin vulnerable to stored Cross-site Scripting

org.jenkins-ci.plugins:teamconcert

Jenkins Team Concert Plugin cross-site request forgery vulnerability

com.redgate.plugins.redgatesqlci:redgate-sql-ci

Jenkins Redgate SQL Change Automation Plugin has Insufficiently Protected Credentials

org.jenkins-ci.plugins:websphere-deployer

Cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin

org.jenkins-ci.plugins:websphere-deployer

Jenkins WebSphere Deployer Plugin missing permission check

org.jenkins-ci.plugins:rundeck

Jenkins Rundeck Plugin stored credentials in plain text

com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

Missing permission check in Jenkins Build Failure Analyzer Plugin

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger

Missing permission check in Jenkins Gerrit Trigger Plugin

com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

Cross-Site Request Forgery in Jenkins Build Failure Analyzer Plugin

org.jenkins-ci.plugins.m2release:m2release

Jenkins Maven Release Plug-in Plugin XXE vulnerability

org.jenkins-ci.plugins.m2release:m2release

Cross-site request forgery (CSRF) vulnerability in Jenkins Maven Release Plugin

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger

Cross-Site Request Forgery in Jenkins Gerrit Trigger Plugin

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

Possible to circumvent title-blacklist

nokogiri

Nokogiri implementation of libxslt vulnerable to heap corruption

modoboa-dmarc

Modoboa is vulnerable to an XML External Entity Injection (XXE)

keystone, keystone

OpenStack Keystone Credential Leakage

phpmyadmin/phpmyadmin

phpMyAdmin unsanitized Git information

gitbook

GitBook allows Cross-site Scripting via a local .md file.

github.com/kubernetes-csi/external-provisioner, github.com/kubernetes-csi/external-provisioner, github.com/kubernetes-csi/external-provisioner, github.com/kubernetes-csi/external-provisioner, github.com/kubernetes-csi/external-provisioner, github.com/kubernetes-csi/external-snapshotter/v6, github.com/kubernetes-csi/external-snapshotter/v6, github.com/kubernetes-csi/external-snapshotter/v6, github.com/kubernetes-csi/external-resizer, github.com/kubernetes-csi/external-resizer

Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access

org.keycloak:keycloak-parent

Keycloak Authentication Error

org.keycloak:keycloak-parent

Keycloak Authentication Error

cli

Duplicate Advisory: Node CLI Allows Arbitrary File Overwrite

freeipa, freeipa, freeipa, ipa, ipa, ipa

FreeIPA logs passwords embedded in commands in calls using batch

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

ansible, ansible, ansible

Ansible password prompts could expose passwords

katello

Katello cleartext password storage issue