Open Source Vulnerabilities

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal Reflected file download vulnerability

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal sensitive information disclosure

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal Brute force amplification attacks via XML-RPC

tripleo-heat-templates

OpenStack TripleO Heat templates spoof metadata requests

org.apache.ranger:ranger

Apache Ranger Access Restriction Bypass

drupal/core, drupal/drupal

Drupal Open redirect vulnerability in the drupal_goto function

org.apache.portals.jetspeed-2:jetspeed

Path Traversal in Apache Jetspeed

org.apache.portals.jetspeed-2:jetspeed-commons

Apache Jetspeed vulnerable to Cross-site Scripting

org.apache.portals.jetspeed-2:jetspeed

Apache Jetspeed vulnerable to SQL Injection

roundup

Roundup sensitive data disclosure vulnerability

org.apache.portals.jetspeed-2:jetspeed

Cross-site Scripting in Apache Jetspeed

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal File upload access bypass and denial of service

tripleo-heat-templates

TripleO Heat templates might allow remote attackers to obtain sensitive information from private containers

org.owasp.esapi:esapi

Missing Cryptographic Step in OWASP Enterprise Security API for Java

drupal/core, drupal/drupal

Drupal arbitrary code execution

symfony/security-http, symfony/security-http, symfony/security-http, symfony/security-http, symfony/security, symfony/security, symfony/security, symfony/security, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony

Symphony Denial of Service Via Overlong Usernames

symfony/security-core, symfony/security-core, symfony/security, symfony/security, symfony/security, symfony/symfony, symfony/symfony, symfony/symfony

Symfony Cryptographic Vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Cross-Site Scripting (XSS)

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows attackers to execute arbitrary jobs

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Remote Attackers to Hijack Sessions

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows attackers to configure restricted projects

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Vulnerable to Clickjacking

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins does not invalidate the API token when a user is deleted

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkin allows attackers to obtain passwords by reading the HTML source code

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows attackers to determine whether a user exists

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Denial of Service vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows attackers to obtain sensitive information

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins session fixation vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins cross-site scripting (XSS) vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Input During Web Page Generation in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs

org.jenkins-ci.main:jenkins-core

Jenkins improperly ensures trust separation

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows for Code Execution via Crafted Packet to the CLI

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins does not Restrict Reserved Names Allowing for Privilege Escalation

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows for Privilege Escalation by Remote Authenticated Users

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Cross-Site Scripting (XSS)

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Cross-site Scripting vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows for Privilege Escalation by Remote Authenticated Users

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Vulnerable to Denial of Service (DoS)

com.liferay:com.liferay.portal.search.web

Liferay Portal Vulnerable to XSS in Profile Search Functionality

neutron

OpenStack Neutron Race condition vulnerability

org.jvnet.hudson.plugins:monitoring

Jenkins Monitoring Plugin Reveals Sensitive Information via Unspecified Pages

org.jenkins-ci.plugins:exclusion

Jenkins Exclusion Plugin allows Access to Resource Locks

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Cross-Site Request Forgery vulnerabilities

org.jvnet.hudson.plugins:monitoring

Jenkins Monitoring Plugin allows Cross-Site Scripting (XSS)

com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

Jenkins Build Failure Analyzer Plugin allows Cross-Site Scripting (XSS)

djblets, djblets

Djiblets Cross-site scripting Vulnerability via JSON Objects