Open Source Vulnerabilities

centreon/centreon

Centreon Sensitive Data Exposure

centreon/centreon

Centreon Does Not Set HTTPOnly Flag

ansible, ansible, ansible

Ansible Uses Plugins That Disclose Credentials

centreon/centreon

Centreon Privilege Escalation

nilsteampassnet/teampass

TeamPass Stored Cross-site Scripting

nilsteampassnet/teampass

TeamPass Stored Cross-site Scripting

nilsteampassnet/teampass

TeamPass Stored Cross-site Scripting

com.liferay.portal:release.portal.bom

Liferay Portal Allows RCE via Deserialization of a JSON Payload

pl.droidsonroids.gif:android-gif-drawable

android-gif-drawable Double Free vulnerability

wolfcrypt

wolfCrypt leaks cryptographic information via timing side channel

org.glassfish:javax.faces, org.glassfish:jakarta.faces

Cross-site Scripting in Eclipse Mojarra

cargo

Cargo prior to Rust 1.26.0 may download the wrong dependency

org.codehaus.jackson:jackson-mapper-asl

Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl

com.mtvi.plateng.hudson:ldapemail

Jenkins LDAP Email Plugin shows plain text password in configuration form

org.apache.mina:mina-core, org.apache.mina:mina-core

Cleartext Transmission of Sensitive Information in Apache MINA

org.jenkins-ci.plugins:script-security

Improper Control of Generation of Code in Jenkins Script Security Plugin

org.jenkins-ci.plugins:vault-scm-plugin

Jenkins SourceGear Vault plugin transmits credentials in plain text

org.jenkins-ci.plugins:htmlpublisher

Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting

io.jenkins.plugins:dingding-notifications

DingTalk Plugin stores credentials in plain text

phpbb/phpbb

phpBB Cross-Site Request Forgery (CSRF)

dolibarr/dolibarr

Dolibarr stored Cross-site Scripting in an Email Template section

dolibarr/dolibarr

Dolibarr stored Cross-site Scripting vulnerability

dolibarr/dolibarr

Dolibarr Cross-site Scripting in a User Note section

dolibarr/dolibarr

Dolibarr Cross-site Scripting in a User Profile in a Signature section

phpbb/phpbb

phpBB Cross-Site Request Forgery (CSRF)

mediawiki/core, mediawiki/core, mediawiki/core

MediaWiki information disclosure

silverstripe/framework, silverstripe/framework

SilverStripe asset-admin Cross-site Scripting (XSS)

org.jenkins-ci.plugins:gcal

Jenkins Google Calendar Plugin has Insufficiently Protected Credentials

com.technicolor:elOyente

Jenkins elOyente Plugin has Insufficiently Protected Credentials

silverstripe/framework, silverstripe/admin, silverstripe/framework

Silverstripe Flash Clipboard Reflected XSS

org.jenkins-ci.plugins:violation-comments-to-gitlab

Violation Comments to GitLab Plugin has Insufficiently Protected Credentials

org.jenkins-ci.plugins:azure-event-grid-notifier

Jenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials

org.jenkins-ci.plugins:violation-comments-to-gitlab

Jenkins Violation Comments to GitLab Plugin has Insufficiently Protected Credentials

io.fabric8.pipeline:kubernetes-pipeline-steps

Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin

io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps

Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin

de.wellnerbou.jenkins:git-changelog

Jenkins Git Changelog Plugin has Insufficiently Protected Credentials

org.jenkins-ci.plugins:application-director-plugin

Jenkins vFabric Application Director Plugin Insufficiently Protected Credentials

org.ukiuni.callOtherJenkins:call-remote-job-plugin

Jenkins Call Remote Job Plugin has Insufficiently Protected Credentials

com.villagechief.codescan.jenkins:codescan

Jenkins CodeScan Plugin has Insufficiently Protected Credentials

org.jenkins-ci.plugins:assembla

Jenkins Assembla Plugin has Insufficiently Protected Credentials

com.inedo.proget:inedo-proget

Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information

hudson.plugins:project-inheritance

Missing permission check in Jenkins Project Inheritance Plugin

com.datatheorem.mobileappsecurity.jenkins.plugin:datatheorem-mobile-app-security

Jenkins Data Theorem Mobile Security: CI/CD Plugin has Insufficiently Protected Credentials

com.inedo.proget:inedo-proget

Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form

hudson.plugins:project-inheritance

Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery

org.jenkins-ci.plugins:log-parser

Jenkins Log Parser Plugin vulnerable to Cross-site Scripting

yiisoft/yii2-dev, yiisoft/yii2-elasticsearch

Yii Framework Code Injection

devise_token_auth

Devise Token Auth vulnerable to Cross-site Scripting

joomla/joomla-cms

Joomla! XSS in Default Templates

org.apereo.cas:cas-server-support-simple-mfa, org.apereo.cas:cas-server-support-oidc, org.apereo.cas:cas-server-core-services-api, org.apereo.cas:cas-server-support-oauth-core-api, org.apereo.cas:cas-server-support-shell, org.apereo.cas:cas-server-core-services-authentication

Use of Insufficiently Random Values in Apereo CAS