Open Source Vulnerabilities

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Cross-site Scripting in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core, org.kohsuke.stapler:stapler-parent

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Certificate Validation in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Input Validation in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Input Validation in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Input Validation in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Input During Web Page Generation in Jenkins

mercurial

Mercurial missing symlink check

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

OS Command Injection in Jenkins

symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony, symfony/form, symfony/form, symfony/form, symfony/form, symfony/form, symfony/form

Symfony Path Disclosure

org.jboss.mod_cluster:mod_cluster-parent

mod_cluster Denial of Service vulnerability

symfony/security-http, symfony/security-http, symfony/security-http, symfony/security-http, symfony/security-http, symfony/security-http, symfony/security, symfony/security, symfony/security, symfony/security, symfony/security, symfony/security, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony

Symfony Open Redirect

simplesamlphp/simplesamlphp

SimpleSAMLphp Authentication context bypass in the multiauth module

simplesamlphp/simplesamlphp

SimpleSAMLphp XSS Vulnerability

rubygems-update

RubyGems Improper Input Validation vulnerability

simplesamlphp/simplesamlphp

SimpleSAMLphp Signature validation bypass

simplesamlphp/simplesamlphp

SimpleSAMLphp allows timing side-channel attacks

org.jboss.resteasy:resteasy-jaxrs

Denial of service in JBoss resteasy

katello

katello Cross-site Scripting vulnerability

github.com/hpcng/singularity

Singularity Incorrect Access Control

rubygems-update, org.jruby:jruby-stdlib

RubyGems Deserialization of Untrusted Data vulnerability

rubygems-update, org.jruby:jruby-stdlib

RubyGems Improper Verification of Cryptographic Signature vulnerability

rubygems-update, org.jruby:jruby-stdlib

RubyGems Cross-site Scripting vulnerability

rubygems-update, org.jruby:jruby-stdlib

RubyGems Improper Input Validation vulnerability

shopware/shopware

Shopware XXE Vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Special Elements used in an LDAP Query in Jenkins

org.jvnet.hudson.plugins:favorite

Jenkins Favorite Plugin vulnerable to Cross-Site Request Forgery

org.apache.camel:camel-hessian, org.apache.camel:camel-hessian

Apache Camel camel-hessian component vulnerable to Java object deserialization

rsa

Python RSA allows attackers to spoof signatures

org.infinispan:infinispan-core

Deserialization of Untrusted Data in Infinispan

org.biouno:uno-choice

Cross-site Scripting in Jenkins Active Choices plugin

org.jenkins-ci.plugins:deploy

Jenkins Deploy to container Plugin stored plain text passwords in job configuration

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent, com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent, com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent

Cross-site Scripting in wicket-jquery-ui

com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent, com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent, com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent

Cross-site Scripting in wicket-jquery-ui

logstash

Elasticsearch Logstash allows remote attackers to execute arbitrary commands

logstash-core

Logstash Logs Sensitive Information

org.apache.uima:uimafit-core, org.apache.uima:uimaj-core, org.apache.uima:uimaj-core, org.apache.uima:uimaj-as-core

Improper Restriction of XML External Entity Reference in Apache uimaj

curl

curl FTP path confusion leads to NIL byte out of bounds write

org.igniterealtime.openfire:parent

Ignite Realtime Openfire vulnerable to cross-site scripting

web2py

web2py remote code execution via hardcoded encryption key in session.connect function

web2py

web2py exposure of sensitive information

web2py

web2py is vulnerable to password brute-force attack

jsmitty12/phpwhois, phpwhois/phpwhois, brightlocal/phpwhois, david-garcia/phpwhois, ivankristianto/phpwhois, kazist/phpwhois, serluck/phpwhois, simple-updates/phpwhois, truckersmp/phpwhois

phpWhois arbitrary code execution via a crafted whois record

org.apache.geode:geode-core

Apache Geode OQL method invocation vulnerability

bundler

Bundler allows attacker to inject arbitrary code via secondary Gem source