Open Source Vulnerabilities

org.apache.brooklyn:brooklyn

Deserialization of Untrusted Data in Apache Brooklyn

genix/cms

GeniXCMS Cross-site Scripting (XSS) via id parameter

genix/cms

GeniXCMS Cross-site Scripting (XSS) vulnerability via id parameter

genix/cms

GeniXCMS Cross-site Scripting (XSS) via the Menu ID field

genix/cms

GeniXCMS arbitrary PHP code execution

ipython

Improper Neutralization of Input During Web Page Generation in IPython

django, django, django

Django denial of service via empty session record creation

plone, plone, plone, plone, plone, plone

Plone Cross-site Scripting Vulnerability

products-cmfplone, products-cmfplone, plone, plone, plone, plone, plone, plone

Plone unauthorized member addition vulnerability

plone

Plone Header Injection

ipython, ipython

IPython vulnerable to cross site request forgery (CSRF)

egroupware/egroupware

eGroupware Community Edition Stored XSS vulnerability

plone

Plone vulnerable to cross-site request forgery

salt, salt, salt

SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

org.apache.geode:geode-core

Apache Geode gfsh query vulnerability

laravel/framework, illuminate/auth

Laravel Sensitive Data Exposure

commons-jelly:commons-jelly

Improper Restriction of XML External Entity Reference in Jelly

org.apache.wicket:wicket-core, org.apache.wicket:wicket-core

Apache Wicket allows attackers to check for third-party libraries

org.jenkins-ci.plugins:docker-commons

Jenkins Docker Commons Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

org.jenkins-ci.plugins:pollscm

Jenkins Poll SCM Plugin vulnerable to Cross-Site Request Forgery

org.jenkins-ci.plugins:git

Cross-Site Request Forgery in Jenkins Git Plugin

org.jenkins-ci.plugins:github-branch-source

Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery

org.datadog.jenkins.plugins:datadog

Exposure of Sensitive Information in Jenkins Datadog plugin

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

org.jenkins-ci.plugins:dependency-check-jenkins-plugin

Persistent XSS vulnerability in Jenkins OWASP Dependency-Check Plugin

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

org.apache.wicket:wicket-core, org.apache.wicket:wicket-core, org.apache.wicket:wicket-core

Apache Wicket vulnerable to CSRF attacks

UmbracoCMS.Web

Umbraco CMS vulnerable to stored XSS

UmbracoCms.Web

Umbraco CMS XXE Vulnerability

nilsteampassnet/teampass

TeamPass Cross-Site Scripting (XSS)

org.apache.derby:derby

Improper Access Control in Apache Derby

org.apache.struts.xwork:xwork-core

Apache Struts CSRF Vulnerability

ccsv

ccsv Double Free vulnerability

org.jenkins-ci.plugins:role-strategy

CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration

org.jvnet.hudson.plugins:dry

Persistent XSS vulnerability in Jenkins DRY Plugin

org.jvnet.hudson.plugins:analysis-core

Persistent XSS vulnerability in Static Analysis Utilities

org.jenkins-ci.plugins:pipeline-input-step

Jenkins Pipeline: Input Step Plugin

org.apache.myfaces.core:myfaces-core-module, org.apache.myfaces.core:myfaces-core-module

Apache MyFaces Vulnerable to EL Injection

org.jenkins-ci.plugins:sidebar-link

Persisted XSS Vulnerability in Jenkins Sidebar Link Plugin

org.jenkins-ci.plugins:github-branch-source

Jenkins GitHub Branch Source Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

org.apache.opennlp:opennlp-tools

Improper Restriction of XML External Entity Reference in Apache OpenNLP

org.jenkins-ci.plugins:subversion

Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability

silverstripe/cms

Silverstripe CMS XSS Vulnerability

io.really:jwt-scala

Insufficient Data Verification in io.really:jwt-scala