Open Source Vulnerabilities

org.jenkins-ci.plugins:depgraph-view

Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting

org.jenkins-ci.plugins:port-allocator

Jenkins Port Allocator Plugin stores credentials in plain text

io.jenkins.docker:docker-plugin

Missing permission check in Jenkins Docker Plugin

org.jenkins-ci.plugins:gogs-webhook

Jenkins Gogs Plugin stored credentials in plain text

io.jenkins.docker:docker-plugin

Missing permission check in Jenkins Docker Plugin

io.jenkins.plugins:embeddable-build-status-plugin

Jenkins Embeddable Build Status Plugin contains Cross-site Scripting

javagh.jenkins:mashup-portlets-plugin

Stored credentials unencrypted in Jenkins Mashup Portlets Plugin

io.jenkins.docker:docker-plugin

Jenkins Docker Plugin contains Cross-Site Request Forgery

code.gitea.io/gitea

Gitea XSS Vulnerability in Repository Description

org.apache.kafka:kafka

Improper Input Validation in Apache Kafka

backdoor in ctx version 0.1.2-1, 0.1.2-2, 0.1.4, 0.2, 0.2.1, 0.2.2, 0.2.2.1, 0.2.3, 0.2.4, 0.2.5, 0.2.6

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

Wikimedia information leak vulnerability

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

Wikimedia MediaWiki allows CSRF

mediawiki/core, mediawiki/core, mediawiki/core

MediaWiki Cross-site Scripting (XSS)

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

Wikimedia MediaWik exposed suppressed log in RevisionDelete page

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

MediaWiki Incorrect Access Control vulnerability

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

MediaWiki Incorrect Access Control vulnerability

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

MediaWiki Incorrect Access Control vulnerability

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

Wikimedia MediaWiki Incorrect Access Control vulnerability

paypal/adaptivepayments-sdk-php

paypal/adaptivepayments-sdk-php vulnerable to a reflected XSS

contao/contao, contao/contao, contao/core-bundle, contao/core-bundle

Contao SQL injection in the file manager

chriskacerguis/codeigniter-restserver

CodeIgniter Rest Server XXE Vulnerability

intelliants/subrion

Subrion CMS XSS

novaksolutions/infusionsoft-php-sdk

infusionsoft-php-sdk reflected Cross-site Scripting

nokogiri

libxslt Type Confusion vulnerability that affects Nokogiri

mxgraph

mxGraph vulnerable to cross-site scripting in color field

nokogiri

Uninitialized read in Nokogiri gem

github.com/grafana/grafana

Grafana Cross-site Scripting vulnerability

linotp

LinOTP replay vulnerability with auto resynchronization enabled for TOTP token

moodle/moodle

Moodle all messaging conversations could be viewed

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Open Redirect Vulnerability

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Private files uploaded via incoming mail processing could bypass quota restrictions

github.com/prasmussen/glot-code-runner

glot-code-runner RCE

openstack-magnum

Openstack Magnum Unsafe Credential Handling

mantisbt/mantisbt

MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO

craftcms/cms

Craft CMS XSS Vulnerability

shopware/shopware

Shopware Insecure Deserialization Vulnerability

silverstripe/restfulserver, silverstripe/registry, silverstripe/registry, silverstripe/restfulserver, silverstripe/restfulserver

silverstripe restfulserver and registry modules SQL injection vulnerability

org.jenkins-ci.plugins:electricflow

Jenkins ElectricFlow Plugin missing permission check

org.jenkins-ci.plugins:electricflow

Jenkins ElectricFlow Plugin cross-site request forgery vulnerability

org.jenkins-ci.plugins:electricflow

Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability

org.jenkins-ci.plugins:token-macro

Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin

org.jenkins-ci.plugins:electricflow

Jenkins ElectricFlow Plugin Missing permission checks

org.jenkins-ci.plugins:jx-resources

Jenkins JX Resources Plugin cross-site request forgery vulnerability

org.jenkins-ci.plugins:electricflow

Jenkins ElectricFlow Plugin is vulnerable to reflected cross site scripting vulnerability

org.jenkins-ci.plugins:electricflow

Jenkins ElectricFlow Plugin globally and unconditionally disabled SSL/TLS certificate validation

org.jenkins-ci.plugins:jx-resources

Jenkins JX Resources Plugin missing permission check

fat_free_crm

Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability

github.com/rancher/rancher

Rancher Login Parameter Can Be Edited