Open Source Vulnerabilities

org.jenkins-ci.plugins:libvirt-slave

Jenkins Libvirt Slaves Plugin vlnerable to Cross-Site Request Forgery

com.elasticbox.jenkins-ci.plugins:kubernetes-ci

Jenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery

org.jenkins-ci.plugins:dynatrace-dashboard

Jenkins Dynatrace Plugin vulnerable to Cross-Site Request Forgery

org.jenkins-ci.plugins.plugin:fireline

Jenkins 360 FireLine Plugin vulnerable to XML External Entity Reference

com.elasticbox.jenkins-ci.plugins:kubernetes-ci

Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization

org.jenkins-ci.plugins:mattermost

Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token

org.sonatype.nexus:nexus-repository, org.sonatype.nexus:nexus-repository

Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager

nokogiri

Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability

yiisoft/yii2-dev, yiisoft/yii2-dev, yiisoft/yii2-dev

Yii SQL injection vulnerability

Rambox

Rambox RCE Vulnerability

dolibarr/dolibarr

Dolibarr Cross-site Scripting vulnerability

dolibarr/dolibarr

Dolibarr Cross-site Scripting via outgoing email setup feature

dolibarr/dolibarr

Dolibarr Cross-site Scripting via outgoing email setup feature

dolibarr/dolibarr

Dolibarr ERP and CRM HTML Injection

sjbr/sr-freecap, sjbr/sr-freecap

sr_freecap for Typo3 RCE Vulnerability

slub/slub-events

slub_events for Typo3 Arbitrary File Upload

sfroemken/url_redirect

url_redirect for Typo3 SQLi Vulnerability

directmailteam/direct-mail

direct_mail for Typo3 sensitive data exposure

org.mule.runtime:mule

Mulesoft Mule Unsafe Deserialization

org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline

Incorrect Authorization in Puppet Enterprise Pipeline Jenkins Plugin

org.jenkins-ci.plugins:rundeck

Jenkins Rundeck Plugin CSRF vulnerability

org.jenkins-ci.plugins:delphix

Jenkins Delphix Plugin vulnerable to Cleartext credential storage

org.jenkins-ci.plugins:view26

Jenkins View26 Test-Reporting Plugin stores access token in plain text

org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic

Missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin

com.soasta.jenkins:cloudtest

Jenkins SOASTA CloudTest Plugin stores API token in plain text

org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic

Jenkins Oracle Cloud Infrastructure Compute Classic Plugin cross-site request forgery vulnerability

org.jenkins-ci.plugins:fortify-on-demand-uploader

Jenkins Fortify on Demand Plugin stores credentials in plain text

org.jenkins-ci.plugins:rundeck

Missing permission check in Jenkins Rundeck Plugin

com.elasticbox.jenkins-ci.plugins:elasticbox

Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin

org.jenkins-ci.plugins:icescrum

Jenkins iceScrum Plugin stores credentials in Cleartext

org.jenkins-ci.plugins:crx-content-package-deployer

Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization

org.jenkins-ci.plugins:vmanager-plugin

Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification

io.jenkins.plugins:sofy-ai

Jenkins Sofy.AI Plugin stores API token in plain text

org.jenkins-ci.plugins:google-oauth-plugin

Improper Limitation of a Pathname to a Restricted Directory in Jenkins Google OAuth Credentials Plugin

jenkins.xtc:extensivetesting

Cleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin

org.jenkins-ci.plugins:neoload-jenkins-plugin

Jenkins NeoLoad Plugin stores credentials in cleartext

org.jenkins-ci.plugins:icescrum

Jenkins iceScrum Plugin vulnerable to Missing Authorization

org.jenkins-ci.plugins:bumblebee

Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation

org.jenkins-ci.plugins:icescrum

Jenkins iceScrum Plugin vulnerable to Cross-site Request Forgery

org.jenkins-ci.plugins:google-kubernetes-engine

Missing permission checks in Google Kubernetes Engine Jenkins Plugin

org.jenkins-ci.plugins:crx-content-package-deployer

Jenkins CRX Content Package Deployer Plugin subject to Cross-Site Request Forgery

org.jenkins-ci.plugins:crx-content-package-deployer

Jenkins CRX Content Package Deployer Plugin subject to Missing Authorization

org.keycloak:keycloak-model-infinispan, org.keycloak:keycloak-model-jpa

Keycloak Unauthenticated Access

org.wildfly.core:wildfly-host-controller

Wildfly Authorization Misconfiguration

ansible, ansible, ansible, ansible

Ansible leaks sensitive information to logs when told not to

craftcms/cms

Craft CMS XSS Vulnerability

encore/laravel-admin

z-song laravel-admin XSS via the Slug or Name on the Roles screen

koji, koji, koji, koji, koji

koji hub allows arbitrary upload destinations

mantisbt/mantisbt, mantisbt/mantisbt

MantisBT Remote Code Execution

octavia, octavia, octavia

OpenStack Octavia Amphora-Agent not requiring Client-Certificate