Open Source Vulnerabilities

ansible

Ansible Sandbox Escape via Symlink Attack

sosreport

SoSReport Predictable Tmp File Names

io.netty:netty, io.netty:netty, io.netty:netty, io.netty:netty, io.netty:netty, io.netty:netty-all

Netty denial of service vulnerability

sickrage

SiCKRAGE Discloses Plaintext Credentials

rap2hpoutre/laravel-log-viewer

Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0

Microsoft.ChakraCore

ChakraCore information disclosure vulnerability

Microsoft.ChakraCore

ChakraCore Security Bypass

Microsoft.ChakraCore

ChakraCore information disclosure vulnerability

org.apache.sentry:sentry

Apache Sentry may allow attacker to access/remove data from Sentry protected table

org.apache.pdfbox:pdfbox, org.apache.pdfbox:pdfbox

Loop with Unreachable Exit Condition in Apache PDFBox

org.apache.cassandra:cassandra-all

Missing Authentication for Critical Function in Apache Cassandra

simplesamlphp/saml2, simplesamlphp/saml2, simplesamlphp/saml2

SimpleSAMLphp Improper Verification of Cryptographic Signature

npm

Incorrect Permission Assignment for Critical Resource in NPM

ep_etherpad-lite

Etherpad Lite Access Restriction Bypass

simplesamlphp/simplesamlphp

SimpleSAMLphp Use of insecure connection charset (sqlauth module)

mysql:mysql-connector-java

Improper Privilege Management in MySQL Connectors Java

craftcms/cms

Craft CMS Vulnerable to Server-Side Template Injection

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Incorrect Authorization in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Missing Release of Resource after Effective Lifetime in Jenkins

org.jenkins-ci.main:jenkins-core

Infinite Loop in Jenkins Core

org.jenkins-ci.plugins:accurev

Jenkins Accurev Plugin CSRF vulnerability and missing permission checks

org.jenkins-ci.plugins:maven-artifact-choicelistprovider

Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks

org.csanchez.jenkins.plugins:kubernetes

Exposure of Sensitive Information in Jenkins Kubernetes Plugin

org.jenkins-ci.plugins:pangolin-testrail-connector

Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks

org.jenkins-ci.plugins:ssh-agent

Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log

athlon1600/php-proxy

Weak Cryptography in PHP-Proxy

showdoc/showdoc

Showdoc Unauthenticated Access

phpbb/phpbb

phpBB Remote Code Execution

pg-query, pglast

libpg_query memory leak

asciidoctor

Asciidoctor Infinite Loop vulnerability

TGServiceInterface

Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server

ansible, ansible, ansible

Ansible Leaks Data Passed to ssh-keygen

matrix-synapse, matrix-synapse

Matrix Synapse Improper Signature Validation

openssl, openssl

Ruby Openssl Allows Incorrect Value Comparison

aubio

Aubio is vulnerable to out of bound read when samplerate > 50kHz

oxid-esales/paymorrow-module, oxid-esales/paymorrow-module

Paymorrow Improper Input Validation vulnerability

org.apache.guacamole:guacamole-common

Missing Encryption of Sensitive Data in Apache Guacamole

cloudtoken

Cloudtoken Insufficiently Protects Credentials

org.apache.jmeter:ApacheJMeter

Missing certificate validation in Apache JMeter

net.opentsdb:opentsdb

OpenTSDB vulnerable to OS Command Injection

org.apache.jmeter:ApacheJMeter

Missing certificate validation in Apache JMeter

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings may allow authenticated attacker to deny service for privileged users

passenger

Phusion Passenger incorrect permission assignment

froxlor/froxlor

Froxlor Incorrect Access Control

express-cart

express-cart allows any user to create an admin user

matrix-synapse

Matrix Synapse Authorization Error

matrix-synapse

Matrix Synapse Security Filtering Flaw

passenger

Incorrect Access Control in Phusion Passenger

passenger

Insecure Permissions in Phusion Passenger

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Cross-site Scripting