Open Source Vulnerabilities

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Improper Privilege Management

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA accepts refresh token as access token on admin endpoints

pulpcore

Withdrawn Advisory: Pulp Improper Path Parsing

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames

osxcollector

Yelp OSXCollector Improper Certificate Validation

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Loop with Unreachable Exit Condition in Jenkins

org.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins:script-security

Jenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass

org.jenkins-ci.plugins:script-security

Improper Privilege Management in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

io.jenkins:configuration-as-code

Jenkins Configuration as Code Plugin has Insufficiently Protected Credentials

org.grails.plugins:asset-pipeline, org.grails.plugins:asset-pipeline, org.grails.plugins:asset-pipeline

Asset Pipeline Grails Plugin vulnerable to Path Traversal

org.jenkins-ci.plugins:zos-connector

Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password

com.coravy.hudson.plugins.github:github

CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials

org.jenkins-ci.plugins:openstack-cloud

CSRF vulnerability and missing permission checks in Openstack Cloud Plugin allowed capturing credentials

org.jenkins-ci.plugins:mesos

Improper authorization vulnerability in Jenkins Mesos Plugin

com.amazonaws:aws-codepipeline

Jenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials

com.amazonaws:codedeploy

AWS CodeDeploy Plugin stored AWS Secret Key in plain text

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Authorization in Jenkins

com.amazonaws:aws-codebuild

Insufficiently Protected Credentials in Jenkins AWS CodeBuild Plugin

cobbler

Cobbler Improper Validation of Security Tokens

modx/revolution

MODX Revolution Incorrect Access Control vulnerability

org.jenkins-ci.plugins:absint-astree

CSRF vulnerability and missing permission checks in Jenkins AbsInt Astrée Plugin

com.blackducksoftware.integration:blackduck-hub

Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration

org.jenkins-ci.plugins:liquibase-runner

Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM

org.jenkins-ci.plugins:vsphere-cloud

Jenkins vSphere Plugin incorrect authorization vulnerability

org.jvnet.hudson.plugins:perforce

Jenkins Perforce Plugin uses ineffective credentials encryption

lightsaml/lightsaml

LightSAML Incorrect Access Control vulnerability

org.jenkins-ci.plugins:promoted-builds

Jenkins Promoted Builds Plugin allowed unauthorized users to run some promotion processes

org.jenkins-ci.plugins:mercurial

Incorrect Authorization in Jenkins Mercurial Plugin

com.unboundid:unboundid-ldapsdk

Weak Password Requirements in UnboundID LDAP SDK

org.jenkins-ci.plugins:subversion

Jenkins Subversion Plugin Incorrect Authorization vulnerability

org.jenkins-ci.plugins:git

Incorrect Authorization in Jenkins Git Plugin

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger

Incorrect Authorization in Jenkins Gerrit Trigger Plugin

com.synopsys.jenkinsci:ownership

Improper authorization in Jenkins Job and Node Ownership Plugin

rubygems-update, org.jruby:jruby-stdlib

RubyGems Infinite Loop vulnerability

org.jenkins-ci.plugins:coverity

Jenkins Coverity Plugin has Insufficiently Protected Credentials

org.jenkins-ci.plugins:google-play-android-publisher

Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger

Incorrect Authorization in Jenkins Gerrit Trigger Plugin

org.jenkins-ci.plugins:credentials-binding

Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials

kreait/firebase-php

Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

baserproject/basercms, baserproject/basercms

baserCMS vulnerable to Access Control Bypass

baserproject/basercms, baserproject/basercms

baserCMS Access Control Bypass

org.apache.geode:geode-core

Apache Geode vulnerable to Exposure of Sensitive Information

org.apache.mesos:mesos, org.apache.mesos:mesos, org.apache.mesos:mesos

Use after free in Apache Mesos

github.com/juju/juju

Juju uses a UNIX domain socket without setting appropriate permissions

dolibarr/dolibarr

Dolibarr allows password changes without supplying the current password

Microsoft.AspNetCore.Mvc.Core, Microsoft.AspNetCore.Mvc.Core, Microsoft.AspNetCore.Mvc.Cors, Microsoft.AspNetCore.Mvc.Cors

Cross-origin Resource Sharing bypass in ASP.NET Core

genix/cms

GeniXCMS Mailbox validation logic vulnerability

craftcms/cms

Craft CMS Unauthorized View