Open Source Vulnerabilities

django-anymail

django-anymail Includes Sensitive Information in Log Files

yiisoft/yii2-redis

yii2-redis Potential Remote code execution

getgrav/grav

Grav CMS Cross-site scripting (XSS) vulnerability

org.apache.openjpa:openjpa, org.apache.openjpa:openjpa

Deserialization of Untrusted Data in Apache OpenJPA

quickapps/cms

QuickAppsCMS Cross-Site Request Forgery (CSRF)

github.com/hashicorp/terraform-provider-aws

HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG

github.com/docker/notary

Docker Notary Signature Algorithm Not Matched to Key vulnerability

typo3/cms

Typo3 XSS Vulnerability

gleez/cms, gleez/cms

Gleez CMS Stored XSS

org.wildfly:wildfly-parent, org.wildfly:wildfly-undertow

WildFly has incomplete blacklist vulnerability

org.apache.hadoop:hadoop-common

Insecure Inherited Permissions in Apache Hadoop

ldap_fluff

ldap_fluff authentication bypass

org.jenkins-ci.plugins:cucumber-living-documentation

Jenkins Cucumber Living Documentation Plugin Cross-site Scripting vulnerability

org.jvnet.hudson.plugins:perforce

Jenkins Perforce Plugin exposure of sensitive information vulnerability exists

org.jenkins-ci.plugins:reverse-proxy-auth-plugin

Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users

org.jenkins-ci.plugins:vsphere-cloud

Jenkins vSphere Plugin disables SSL/TLS certificate validation by default

org.jenkins-ci.plugins:ghprb

Jenkins GitHub Pull Request Builder Plugin

org.jenkins-ci.plugins:ghprb

Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentials

org.jenkins-ci.plugins:vsphere-cloud

Jenkins vSphere Plugin Cross-Site Request Forgery vulnerability

org.jenkins-ci.plugins:copy-to-slave

Jenkins Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

dolibarr/dolibarr

Dolibarr Cross-Site Scripting (XSS) vulnerability

dolibarr/dolibarr

Dolibarr SQL injection via type parameter in product/stats/card.php

dolibarr/dolibarr

Dolibarr SQL injection vulnerability

topthink/framework

thinkphp SQL Injection via the index.php s parameter

moodle/moodle

Moodle Cross-site Scripting in the Course summary filter of the Add a new course

phpmyadmin/phpmyadmin

phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution

suricata-update

OISF suricata-update unsafely deserializes YAML data

tryton, tryton, tryton, tryton, trytond, trytond, trytond, trytond, trytond

Tryton vulnerable to arbitrary command execution

genix/cms

GeniXCMS Cross-site scripting (XSS) vulnerability

rainlab/user-plugin

User Plugin for October CSS Allows XSS

dolibarr/dolibarr

Dolibarr Cross-site scripting (XSS) vulnerability

matrix-synapse

Matrix Synapse DoS

org.jenkins-ci.plugins:google-login

Jenkins Google Login Plugin Open Redirect vulnerability

org.jenkins-ci.plugins:google-login

Jenkins Google Login Plugin Session Fixation vulnerability

org.jenkins-ci.plugins:s3

Stored XSS vulnerability in Jenkins S3 Publisher Plugin

org.jenkins-ci.plugins:htmlpublisher

Jenkins HTML Publisher Plugin path traversal vulnerability

org.jenkins-ci.plugins:email-ext

Jenkins Email Extension Plugin showed plain text SMTP password in configuration form field

joomla/joomla-cms

Joomla! XSS Vulnerability

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Portfolio forum caller class allows a user to download any file

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Portfolio script allows instantiation of class chosen by user

org.apache.nifi:nifi

Apache NiFi JMS Deserialization issue

org.apache.nifi:nifi-standard-processors

Improper Restriction of XML External Entity Reference in Apache NiFi

org.graylog2:graylog2-server

Cross-site Scripting in Graylog

org.graylog2:graylog2-server

Cross-site Scripting in Graylog Server

opencart/opencart

OpenCart Path Traversal

opencart/opencart

OpenCart Path Traversal

org.apache.struts:struts-core, struts:struts

Improper Input Validation in Apache Struts

org.apache.struts:struts2-core

Special top object can be used to access Struts' internals

org.apache.struts:struts2-core

Apache Struts vulnerable to possible DoS attack when using URLValidator