Open Source Vulnerabilities

github.com/rancher/rancher, github.com/rancher/rancher

Rancher Privilege Escalation Vulnerability

github.com/rancher/rancher

Rancher code injection via fluentd config commands

phpmyadmin/phpmyadmin

phpMyAdmin CSRF Vulnerability

phpmyadmin/phpmyadmin

phpMyAdmin SQL injection in Designer feature

org.grails:grails-core

Incorrect Resource Transfer Between Spheres in Grails

com.liferay.portal:release.portal.bom

Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API

octavia

Openstack Octavia Access Control Vulnerability

pydio

PyDio Stored XSS Vulnerability

github.com/hybridgroup/gobot

Hybrid Group Gobot Improper Certificate Validation vulnerability

github.com/traefik/traefik

Containous Traefik Exposes Password Hashes

prestashop/prestashop

PrestaShop Cross-site Scripting vulnerability

symfony/security-core, symfony/security-core, symfony/security-core, symfony/security-core, symfony/security, symfony/security, symfony/security, symfony/security, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony

Symfony Incorrect Access Control

Blogifier.Core

Blogifier does not properly restrict APIs

golang.org/x/crypto

Golang/x/crypto message forgery vulnerability

com.hazelcast:hazelcast

Deserialization of Untrusted Data in Hazelcast

org.jenkins-ci.plugins:credentials

Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin

Microsoft.AspNetCore.SignalR.Protocols.MessagePack, Microsoft.AspNetCore.SignalR.Protocols.MessagePack

Denial of service in ASP.NET Core

System.Private.Uri

Denial of service in ASP.NET Core

ezsystems/ezplatform-admin-ui, ezsystems/ezplatform-admin-ui

ezplatform-admin-ui Cross-site Scripting (XSS) vulnerability

System.Private.Uri

Denial of service in ASP.NET Core

org.kie.server:kie-server-common

Password in config file in KIE server

capstone

Capstone SEGV caused by a read memory access

golang.org/x/crypto

golang.org/x/crypto/salsa20/salsa uses insufficiently random values

matrix-sydent, matrix-synapse

matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG

typo3/phar-stream-wrapper, typo3/phar-stream-wrapper

PharStreamWrapper for Typo3 unsafe deserialization vulnerability

org.apache.karaf.config:org.apache.karaf.config.core

Apache Karaf vulnerable to relative path traversal

org.opencms:opencms-core

Alkacon OpenCMS CSV Injection via New User module

org.eclipse.xtext:org.eclipse.xtext, org.eclipse.xtend:org.eclipse.xtend.core

Potentially compromised builds

impresscms/impresscms

ImpressCMS XSS

phpbb/phpbb

phpBB Server side request forgery (SSRF)

phpbb/phpbb

phpBB Denial of Service

org.jenkins-ci.plugins:azure-ad

Jenkins Azure AD Plugin stored the client secret unencrypted

org.jvnet.hudson.plugins:sitemonitor

Jenkins SiteMonitor Plugin globally and unconditionally disables SSL/TLS certificate validation

org.jenkins-ci.plugins:koji

Jenkins Koji Plugin globally and unconditionally disables SSL/TLS certificate validation

org.jenkins-ci.plugins:ansible-tower

Missing permission check in Jenkins Ansible Tower Plugin

org.jenkins-ci.plugins:aqua-microscanner

Jenkins Aqua MicroScanner Plugin stored credentials in plain text

org.jenkins-ci.plugins:ansible-tower

Jenkins Ansible Tower Plugin missing permission check

org.jenkins-ci.plugins:github-oauth

Jenkins GitHub Authentication Plugin Cross-Site Request Forgery vulnerability

org.jenkins-ci.plugins:ansible-tower

Jenkins Ansible Tower Plugin cross-site request forgery vulnerability

org.jvnet.hudson.plugins:analysis-core

Missing permission check in Jenkins Static Analysis Utilities Plugin

org.jenkins-ci.plugins:twitter

Jenkins Twitter Plugin stores credentials in plain text

org.jvnet.hudson.plugins:analysis-core

Jenkins Static Analysis Utilities Plugin is vulnerable to Cross-site request forgery vulnerability

org.jenkins-ci.plugins:swarm

Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response

code.gitea.io/gitea

Gitea Allows 1FA Even for 2FA-Enrolled Accounts

org.apache.portals.pluto:chatRoomDemo

Cross-site Scripting in Apache Pluto Chatroom demo

github.com/envoyproxy/envoy

EnvoyProxy Envoy Missing HTTP URL path normalization

contao/contao, contao/contao, contao/core-bundle, contao/listing-bundle, contao/core-bundle, contao/listing-bundle

Contao SQL injection in the backend and listing module

flarum/flarum

Flarum mishandles invalidation of user email tokens

librenms/librenms

LibreNMS arbitrary OS commands execution

org.apache.qpid:proton-j

Withdrawn Advisory: Improper Certificate Validation in Apache Qpid Proton