Open Source Vulnerabilities

org.keycloak:keycloak-parent, org.keycloak:keycloak-parent, org.keycloak:keycloak-parent

Keycloak vulnerable to cross-site scripting via the state parameter

org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA Privilege Escalation

mistral

openstack-mistral Discloses the presence of arbitrary files within the filesystem

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Login CSRF vulnerability in login form

org.elasticsearch:elasticsearch

Improper Restriction of XML External Entity Reference in Elasticsearch

org.elasticsearch:elasticsearch

Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

org.jboss.resteasy:resteasy-yaml-provider, org.jboss.resteasy:resteasy-yaml-provider

Deserialization of Untrusted Data in org.jboss.resteasy:resteasy-yaml-provider

moodle/moodle, moodle/moodle

Moodle Improper Authentication

io.undertow:undertow-core, io.undertow:undertow-core

Uncontrolled Resource Consumption in Undertow

org.infinispan:infinispan-core, org.infinispan:infinispan-core, org.infinispan:infinispan-core, org.infinispan:infinispan-core, org.infinispan:infinispan-core

Deserialization of Untrusted Data in Infinispan

org.springframework.batch:spring-batch-admin-manager

Cross-site Scripting in Pivotal Spring Batch Admin

express-cart

express-cart unrestricted file upload vulnerability

statics-server

statics-server Cross-site Scripting vulnerability

org.elasticsearch:elasticsearch, org.elasticsearch:elasticsearch

Elasticsearch subject to cross site scripting

nuclide

Nuclide Improper Input Validation

org.jenkins-ci.plugins:active-directory

Jenkins Active Directory Plugin Improper certificate validation with StartTLS

io.jenkins.blueocean:blueocean

Cross-site Scripting in Jenkins Blue Ocean Plugin

org.jenkins-ci.plugins:github-oauth

GitHub Authentication Plugin showed plain text client secret in configuration form

org.jenkins-ci.plugins:job-import-plugin

XXE vulnerability in Jenkins Job Import Plugin

org.jvnet.hudson.plugins:warnings

Sandbox Bypass via CSRF in Jenkins Warnings Plugin

org.jenkins-ci.plugins:config-file-provider

Jenkins Config File Provider Plugin XSS vulnerability

io.jenkins.blueocean:blueocean

Cross-Site Request Forgery in Jenkins Blue Ocean Plugin

io.jenkins.plugins:warnings-ng

Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability

org.jenkins-ci.plugins:kanboard

Jenkins Kanboard Plugin vulnerable to Server-side request forgery (SSRF)

org.jenkins-ci.plugins:oic-auth

Jenkins OpenId Connect Authentication Plugin showed plain text client secret in configuration form

org.jenkins-ci.plugins:job-import-plugin

Jenkins Job Import Plugin vulnerable to exposure of sensitive information

hudson.plugins.octopusdeploy:octopusdeploy

SSRF vulnerability due to missing permission check in Jenkins OctopusDeploy Plugin

org.jenkins-ci.plugins:job-import-plugin

Jenkins Job Import Plugin CSRF vulnerability

io.jenkins.plugins:warnings-ng

XSS vulnerability in Jenkins Warnings Next Generation Plugin

org.jvnet.hudson.plugins:monitoring

Jenkins Monitoring Plugin vulnerable to Denial of service vulnerability

org.jenkins-ci.plugins:github-oauth

GitHub Authentication Plugin session fixation vulnerability

org.jenkins-ci.plugins:mattermost

Jenkins Mattermost Notification Plugin vulnerable to SSRF

org.jenkins-ci.plugins:kmap-jenkins

CSRF vulnerability in Jenkins Nomad Plugin allow SSRF

org.jenkins-ci.plugins:jms-messaging

SSRF vulnerability due to missing permission check in Jenkins JMS Messaging Plugin

org.jenkins-ci.plugins:jenkins-reviewbot

CSRF vulnerability in jenkins-reviewbot Plugin

org.jenkins-ci.plugins:netsparker-cloud-scan

CSRF vulnerability in Jenkins Netsparker Enterprise Scan Plugin

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Stored HTML in assignment submission comments allowed links to be opened directly

moodle/moodle

Moodle Blind SSRF Risk in /badges/mybackpack.php

lavalite/cms

Stored XSS in LavaLite 5.5

ipython

Improper Neutralization of Input During Web Page Generation in IPython

geminabox

Gem in a Box vulnerable to Cross-site Scripting

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

Mediawiki Improper Privilege Management

geminabox

Gem in a Box vulnerable to Cross-site Request Forgery

directmailteam/direct-mail

The Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive information

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

Mediawiki BotPassword can bypass CentralAuth's account lock

modx/revolution

MODX vulnerability allows for XSS via user settings parameters

com.tupilabs.image_gallery:image-gallery

Jenkins Image Gallery Plugin allows Path Traversal

passenger

Phusion Passenger information disclosure

mediawiki/core, mediawiki/core, mediawiki/core, mediawiki/core

Mediawiki information disclosure vulnerability

org.tap4j:tap

Jenkins TAP Plugin allows Path Traversal