Open Source Vulnerabilities

moodle/moodle, moodle/moodle, moodle/moodle

Moodle CSRF Vulnerability

org.jolokia:jolokia-core

Cross-Site Request Forgery in Jolokia

org.jenkins-ci.plugins:skytap

Skytap Cloud CI Plugin stored credentials in plain text

io.jenkins:configuration-as-code

Improper Encoding or Escaping of Output in Jenkins Configuration as Code Plugin

org.jenkins-ci.plugins.m2release:m2release

Jenkins Maven Release Plugin vulnerable to Cross-site Scripting

io.jenkins:configuration-as-code

Cleartext Transmission of Sensitive Information in Jenkins Configuration as Code Plugin

org.jenkins-ci.plugins.m2release:m2release

Jenkins Maven Release Plug-in Plugin stored credentials in plain text

org.jenkins-ci.plugins:ec2

Jenkins Amazon EC2 Plugin leaked beginning of private key in system log

org.jenkins-ci.plugins:google-kubernetes-engine

Jenkins Google Kubernetes Engine Plugin vulnerable to Exposure of Resource to Wrong Sphere

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin

io.jenkins:configuration-as-code

Plaintext Storage of a Password in Jenkins Configuration as Code Plugin

org.jenkins-ci.main:maven-plugin

Maven Integration Plugin did not mask sensitive values in module build logs

io.jenkins:configuration-as-code

Missing Authorization in Jenkins Configuration as Code Plugin

org.jenkins-ci.plugins:script-security

Incorrect Privilege Assignment in Jenkins Script Security Plugin

org.jenkins-ci.plugins.m2release:m2release

Jenkins Maven Release Plugin contains Cross-Site Request Forgery vulnerability

io.jenkins:configuration-as-code

Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin

org.jenkins-ci.plugins:script-security

Return of Pointer Value Outside of Expected Rang in Jenkins Script Security Plugin

elastic-apm

Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

org.elasticsearch:elasticsearch, org.elasticsearch:elasticsearch

Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch

github.com/containers/podman

Podman Path Traversal Vulnerability leads to arbitrary file read/write

github.com/rancher/rancher, github.com/rancher/rancher, github.com/rancher/rancher

Rancher Recreates Default User With Known Password Despite Deletion

ironic-inspector, ironic-inspector, ironic-inspector, ironic-inspector, ironic-inspector

Openstack ironic-inspector has SQL injection vulnerability in node_cache

github.com/docker/docker

Moby Docker cp broken with debian containers

dolibarr/dolibarr

Dolibarr ERP and CRM malicious executable loading

dolibarr/dolibarr

Dolibarr ERP and CRM Code Injection

pterodactyl/panel

Pterodactyl vulnerable to 2FA Sniffing

werkzeug

Pallets Werkzeug vulnerable to Path Traversal

sunhater/kcfinder

SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php

org.apache.storm:storm-core

Exposure of Sensitive Information in Apache Storm Logviewer

passport-sharepoint

Auth0 Passport-SharePoint does not validate JWT signature

github.com/mastercactapus/proxyprotocol

mastercactapus proxyprotocol vulnerable to denial of service

antsword

AntSword RCE and XSS via code injection

org.jenkins-ci.plugins:credentials-binding

Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format

github.com/docker/docker

Secret insertion into debug log in Docker

code.gitea.io/gitea

Gitea XSS Vulnerability

github.com/b3log/wide

b3log Wide unauthenticated file access

salt

SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function

grumpydictator/firefly-iii

Firefly III vulnerable to stored XSS

dolibarr/dolibarr

Dolibarr Cross Site Request Forgery (CSRF)

grumpydictator/firefly-iii

Firefly III vulnerable to reflected cross-site scripting

grumpydictator/firefly-iii

Firefly III vulnerable to image-based stored XSS

grumpydictator/firefly-iii

Firefly III vulnerable to stored XSS

helm.sh/helm

Helm Improper Certificate Validation

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core, org.kohsuke.stapler:stapler-parent

Missing Authorization in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Cross-Site Request Forgery in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

Microsoft.AspNetCore.App, Microsoft.AspNetCore.App, Microsoft.AspNetCore.All, Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.IIS, Microsoft.AspNetCore.Server.HttpSys, Microsoft.AspNetCore.Server.HttpSys

Open redirect in ASP.NET Core

dolibarr/dolibarr

Dolibarr Cross Site Scripting (XSS)

saleor

Mirumee Saleor CSRF Protection Disabled

com.brianfromoregon:caliper-ci

Jenkins Caliper CI Plugin stores credentials in plain text