Open Source Vulnerabilities

pyxdg

pyxdg Arbitrary File Overwrite via Race Condition

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins directory traversal vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins cross-site scripting (XSS) vulnerability

org.apache.poi:poi

Improper Restriction of XML External Entity Reference in Apache POI

salt

SaltStack Salt Insecure Temporary File Creation

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Path Traversal vulnerability

org.apache.poi:poi, org.apache.poi:poi

Improper Input Validation in Apache POI

salt, salt

SaltStack Salt Directory traversal vulnerability in minion id validation

zendframework/zend-diactoros

zend-diactoros Cross-site Scripting (XSS)

org.apache.atlas:atlas-common

Insecure cookie storage in Apache Atlas

org.apache.atlas:atlas-common

Path Traversal in Apache Atlas

org.apache.atlas:atlas-common

Cross-site Scripting in Apache Atlas

org.apache.atlas:atlas-common

Cross-site Scripting in Apache Atlas

simplesamlphp/simplesamlphp

SimpleSAMLphp Incorrect IV generation for encryption

simplesamlphp/simplesamlphp

SimpleSAMLphp Unauthenticated encryption in CBC mode

org.apache.atlas:atlas-common

Apache Atlas produces Stack trace in error response

org.apache.atlas:atlas-common

Cross-site Scripting in Apache Atlas

scrapy

Scrapy denial of service vulnerability

swift

OpenStack Swift metadata constraints are not correctly enforced

co-stack/fal_sftp, vertexvaar/falsftp

fal_sftp extension for TYPO3 uses weak permissions for sFTP driver files and folders

smarty/smarty

Smarty arbitrary PHP code execution

django, django

Django User Enumeration Vulnerability

django, django

Django XSS Vulnerability

org.apache.hadoop:hadoop-yarn-server-nodemanager, org.apache.hadoop:hadoop-yarn-server-nodemanager

Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

designate

Designate mDNS DoS through incorrect handling of large RecordSets

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

dolibarr/dolibarr

Dolibarr SQL injection vulnerability in don/list.php

dolibarr/dolibarr

Dolibarr SQL injection vulnerability in admin/menus/edit.php

dolibarr/dolibarr

Dolibarr ERP and CRM Sensitive Data Disclosure

org.apache.tomcat:tomcat

Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Authentication Bypass in Apache Tomcat

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Cross-Site Request Forgery in Apache Tomcat

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Improper Access Control in Apache Tomcat

python-keystoneclient

python-keystoneclient unsecure user password update

genix/cms

GeniXCMS denial of service (account blockage)

dolibarr/dolibarr

Dolibarr cross-site scripting (XSS) vulnerability

org.apache.directory.api:api-ldap-model

Exposure of Sensitive Information to an Unauthorized Actor in Apache Directory LDAP API

moodle/moodle, moodle/moodle, moodle/moodle

Moodle XSS Vulnerability

org.apache.brooklyn:brooklyn-rest-resources, org.apache.brooklyn:brooklyn-jsgui

Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)

org.jenkins-ci.main:jenkins-core

Jenkins HttpOnly flag not Set for session cookies

org.jenkins-ci.main:jenkins-core

Jenkins secure flag not set on session cookies

org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core

Incomplete exclude pattern in Apache Struts

django

Django ReDoS in validators.URLValidator

django, django, django

Django Vulnerable to HTTP Response Splitting Attack

fastly/magento2

Fastly Magento2 sensitive information disclosure

phpbb/phpbb, phpbb/phpbb

phpBB Open Redirect

org.apache.brooklyn:brooklyn

Cross-site Scripting In Apache Brooklyn

nodebb, nodebb-plugin-markdown

NodeBB Cross-site Scripting Vulnerability in Markdown Processing

moodle/moodle, moodle/moodle, moodle/moodle

Moodle sensitive information disclosure

codeigniter/framework, kohana/core

CodeIgniter and Kohana vulnerable to PHP Object Injection