Open Source Vulnerabilities

com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

Cross-site Scripting in Jenkins Build Failure Analyzer plugin

org.jenkins-ci.plugins:extra-columns

Jenkins Extra Columns Plugin allows Cross-Site Scripting (XSS)

org.zeroturnaround:zt-zip

Improper Limitation of a Pathname to a Restricted Directory in zt-zip

com.nimbusds:nimbus-jose-jwt

Nimbus JOSE+JWT missing overflow check

com.nimbusds:nimbus-jose-jwt

Improper Verification of Cryptographic Signature in Nimbus JOSE+JWT

piwik/piwik, matomo/matomo

Piwik (now Matomo) Vulnerable to Arbitrary Code Execution

matomo/matomo, piwik/piwik

Piwik (now Matomo) Vulnerable to Cross-Site Scripting (XSS)

matomo/matomo, piwik/piwik

Piwik (now Matomo) Reveals Sensitive Information by Accepting Input from `POST` Requests

com.typesafe.play:play_2.12

Play Framework's Assets controller vulnerable to directory traversal

de.wellnerbou.jenkins:git-changelog

Stored XSS vulnerability in Jenkins Git Changelog Plugin

org.jenkins-ci.plugins:anchore-container-scanner

Exposure of sensitive information in Anchore Container Image Scanner Jenkins Plugin

org.apache.atlas:atlas-common

Cross-site Scripting in Apache Atlas

lemur

Lemur uses static IV per key

sosreport

sosreport sensitive information disclosure via weak permissions of the generated archives

org.apache.wicket:wicket-core, org.apache.wicket:wicket-core, org.apache.wicket:wicket-core

Apache Wicket Sensitive Data Exposure

com.datomic:datomic-free

Improper Input Validation in Datomic

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

org.jenkins-ci.main:cli, org.jenkins-ci.main:cli

Jenkins CLI Deserialization of Untrusted Data vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins does not Verify Checksums for Plugin Files

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Administrators to Access API Tokens

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Bypass of Access Restrictions

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins has XML External Entity (XXE) Vulnerability in Job Configuration via CLI

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Exposure of Sensitive Information to an Unauthorized Actor

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Cross-Site Scripting (XSS)

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Unauthorized Viewing of Queue API Information

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins has Local File Inclusion Vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins discloses project names via fingerprints

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins has Information Disclosure via Sidepanel Widget

org.apache.activemq:activemq-client, org.apache.activemq:activemq-client

Improper Input Validation in Apache ActiveMQ

oliverklee/phpunit

PHPUnit extension for TYPO3 vulnerable to Cross-site Scripting

slixmpp, sleekxmpp

SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons

baserproject/basercms

CSRF in baserCMS 3.0.10 and earlier

pear/pear

PEAR core file overwrite vulnerability

org.jsoup:jsoup

Improper Neutralization of Input During Web Page Generation in Jsoup

org.graniteds:granite-core

GraniteDS Insecure Deserialization

tribalsystems/zenario

SQL Injection in Zenario 7.1-7.6

simditor

Simditor XSS Vulnerability

org.graniteds:granite-server-core

GraniteDS Insecure Deserialization

org.richfaces:richfaces, org.richfaces:richfaces

Remote code execution due to insecure deserialization

pimcore/pimcore

Pimcore Unserialize Remote Code Execution

org.apache.wicket:wicket-core, org.apache.wicket:wicket-core, org.apache.wicket:wicket-core

Apache Wicket insecure defaults

org.elasticsearch:elasticsearch, org.elasticsearch:elasticsearch

Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

radicale, radicale

Radicale is vulnerable to timing oracles and simple bruteforce attacks

org.apache.camel:camel-core, org.apache.camel:camel-core, org.apache.camel:camel-core, org.apache.camel:camel-core

Improper Control of Generation of Code in Apache Camel

kallithea

Kallithea Routes CSRF Bypass

kallithea

Kallithea cross-site request forgery (CSRF) vulnerability

kallithea

Kallithea cross-site scripting (XSS) vulnerability

rhodecode, kallithea

RhodeCode and Kallithea are vulnerable to sensitive information disclosure