Open Source Vulnerabilities

org.jenkins-ci.plugins:release

CSRF vulnerability in Jenkins Release plugin

org.jvnet.hudson.plugins:warnings

XXE vulnerability Jenkins Warnings Plugin

org.jenkins-ci.plugins:translation

CSRF vulnerability in Jenkins Translation Assistance plugin

org.jenkins-ci.main:maven-plugin

MitM on Jenkins Maven Plugin

org.jenkins-ci.plugins:swarm-client, org.jvnet.hudson.plugins:swarm-plugin

Jenkins Swarm Plugin Client vulnerable to man-in-the-middle attacks

se.diabol.jenkins.pipeline:delivery-pipeline-plugin

Jenkins Delivery Pipeline Plugin Cross-site Scripting vulnerability

yiisoft/yii2, yiisoft/yii2-dev

Yii Framework Cross-Site Request Forgery (CSRF)

org.jenkins-ci.plugins:global-build-stats

Cross-Site Request Forgery (CSRF) vulnerability in Jenkins global-build-stats plugin

org.jenkins-ci.plugins:script-security

Exposure of Sensitive Information to an Unauthorized Actor Jenkins Script Security Plugin

org.apache.nifi:nifi

Apache NiFi XSS issue in context path handling

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Race Condition in Jenkins

org.jenkins-ci.plugins:ec2

Arbitrary shell command execution in Jenkins EC2 Plugin

org.apache.nifi:nifi

Apache NiFi host header poisoning issue

silverstripe/framework, silverstripe/framework, silverstripe/framework

SilverStripe CSV Excel Macro Injection

org.jasypt:jasypt

Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt

echor

Echor Ruby Gem credentials can be stolen via process table monitoring

echor

Echor contains Command Injection

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Deserialization of Untrusted Data in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Cross-Site Request Forgery in Jenkins

simplesamlphp/simplesamlphp

SimpleSAMLphp Open redirection protection bypass

dijit

dijit editor cross-site scripting vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Authentication in Jenkins

mautic/core

Mautic Cross Site Scripting (XSS) vulnerability

austintoddj/canvas

Canvs Canvas XSS Vulnerability

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

croogo/croogo

Cross site scripting in Croogo

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA SessionID present in Audit Event Logs

simplesamlphp/saml2, simplesamlphp/saml2, simplesamlphp/saml2, simplesamlphp/saml2

SimpleSAMLphp SAML2 spoof SAML responses

org.jvnet.hudson.plugins:android-lint

XXE vulnerability in Jenkins Android Lint Plugin

org.jenkins-ci.plugins:junit

Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin

phpmyadmin/phpmyadmin

phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature

org.jenkins-ci.plugins.workflow:workflow-support

Arbitrary code execution due to incomplete sandbox protection in Pipeline: Supporting APIs Plugin

tikiwiki/tiki-manager

Tiki Wiki CMS XSS Vulnerability

mxgraph

mxGraph vulnerable to XXE attacks

org.jvnet.hudson.plugins:ccm

Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference

org.apache.oozie:oozie-core

Path Traversal in Apache Oozie

org.apache.james.hupa:hupa-parent

Apache James Hupa Webmail application Cross-site Scripting Vulnerabilities

org.apache.geode:geode-core

Apache Geode configuration request authorization vulnerability

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal cross site scripting vulnerability

drupal/core, drupal/drupal

Drupal external link injection vulnerability

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal cross-site scripting vulnerability

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal Comment reply form allows access to restricted content

org.apache.geode:geode-core

Apache Geode unsafe deserialization of application objects

uwsgi

uWSGI Directory Traversal vulnerability

org.apache.geode:geode-core

Apache Geode unsafe deserialization in TcpServer

org.apache.ode:ode

Apache ODE Path Traversal vulnerability

com.liferay.portal:release.portal.bom

Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page

simplesamlphp/saml2, simplesamlphp/saml2, simplesamlphp/saml2

SimpleSAMLphp saml2 incorrect signature validation

org.jenkins-ci.plugins:testlink

Stored cross-site scripting vulnerability in Jenkins TestLink Plugin

org.jenkins-ci.plugins:cppncss

Reflected cross-site-scripting vulnerability in report URL of Jenkins CppNCSS Plugin