Open Source Vulnerabilities

kallithea

Kallithea CRLF injection vulnerability

org.apache.struts:struts2-struts1-plugin

Code execution in Apache Struts 1 plugin

org.springframework.amqp:spring-amqp

Improper Input Validation in Spring AMQP

org.apache.tapestry:tapestry-core

Apache Tapestry Unsafe Object Storage

keystone, keystone

OpenStack Keystone Logs Passwords

keystone

OpenStack Identity Keystone Improper Privilege Management

keystone

OpenStack Identity Keystone Exposure of Sensitive Information

keystone, keystonemiddleware, keystone, keystonemiddleware, keystonemiddleware

OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials

keystone

OpenStack Identity (Keystone) Denial of Service

keystone

OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

golang.org/x/net

golang.org/x/net/html Improper Validation of Array Index vulnerability

github.com/apache/thrift

Apache Thrift Go Library Command Injection

org.jenkins-ci.plugins:slack

Jenkins Slack Notification Plugin CSRF vulnerability and missing permission checks

org.jenkins-ci.plugins:labmanager

Jenkins VMware Lab Manager Slaves Plugin vulnerable CSRF vulnerability

org.jenkins-ci.plugins:fortify-on-demand-uploader

Jenkins Fortify on Demand Uploader Plugin CSRF vulnerability

org.jenkins-ci.plugins:openshift-deployer

CSRF vulnerability in Jenkins OpenShift Deployer Plugin

org.jenkins-ci.plugins:audit2db

CSRF vulnerability in Jenkins Audit to Database Plugin

org.jvnet.hudson.plugins:ftppublisher

CSRF vulnerability in Jenkins FTP publisher Plugin

org.6wind.jenkins:lockable-resources

Jenkins Lockable Resources Plugin XSS vulnerability

org.jenkins-ci.plugins:gearman-plugin

CSRF vulnerability in Jenkins Gearman Plugin

org.jenkins-ci.plugins:sinatra-chef-builder

CSRF vulnerability in Jenkins sinatra-chef-builder Plugin

org.jenkins-ci.plugins:zephyr-enterprise-test-management

CSRF vulnerability in Zephyr Enterprise Test Management Plugin

com.soasta.jenkins:cloudtest

CSRF vulnerability in Jenkins SOASTA CloudTest Plugin

org.jenkins-ci.plugins:nomad

Cross-site request forgery vulnerability in Jenkins Nomad Plugin

org.jenkins-ci.plugins:openid

Jenkins OpenID Plugin CSRF vulnerability

org.codehaus.groovy:groovy, org.codehaus.groovy:groovy-all

Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy

org.apache.sling:org.apache.sling.xss, org.apache.sling:org.apache.sling.xss.compat

Cross site scripting in Apache Sling

dweeves/magmi

MAGMI cross-site scripting (XSS)

dweeves/magmi

MAGMI plugin for Magento Server Directory Traversal

org.python:jython-standalone, org.python:jython

Deserialization of Untrusted Data in Jython

commons-collections:commons-collections, org.apache.commons:commons-collections4, org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections, net.sourceforge.collections:collections-generic, org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic

Deserialization of Untrusted Data in Apache commons collections

org.apache.struts:struts-core, struts:struts

Improper Input Validation in Apache Struts

org.apache.struts:struts-core, struts:struts

Improper Input Validation in Apache Struts

org.codehaus.groovy:groovy, org.codehaus.groovy:groovy-all

Deserialization of Untrusted Data in Groovy

org.apache.kafka:kafka-clients, org.apache.kafka:kafka-clients

Improper Authentication in Apache Kafka

org.apache.myfaces.trinidad:trinidad, org.apache.myfaces.trinidad:trinidad, org.apache.myfaces.trinidad:trinidad, org.apache.myfaces.trinidad:trinidad

Apache MyFaces Trinidad Deserialization Vulnerability

org.jenkins-ci.plugins:openid

Jenkins openid Plugin missing permission check

org.jenkins-ci.plugins:sinatra-chef-builder

Missing permission check in Jenkins sinatra-chef-builder Plugin

org.jenkins-ci.plugins:zephyr-enterprise-test-management

Jenkins Zephyr Enterprise Test Management Plugin missing permission check

org.jenkins-ci.plugins:labmanager

Missing permission check in Jenkins VMware Lab Manager Slaves Plugin

org.jenkins-ci.plugins:gearman-plugin

Missing permission check in Jenkins Gearman Plugin

com.soasta.jenkins:cloudtest

Missing permission check in Jenkins SOASTA CloudTest Plugin

org.jenkins-ci.plugins:openshift-deployer

CSRF vulnerability in Jenkins OpenShift Deployer Plugin

org.jenkins-ci.plugins:nomad

Jenkins Nomad Plugin missing permission check

com.ds.tools.hudson:crowd

Jenkins Crowd Integration Plugin stores credentials in plain text

org.jenkins-ci.plugins:TestFairy

Jenkins TestFairy Plugin stores credentials in plain text

org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-core

Exposure of Resource to Wrong Sphere in Apache Tomcat

com.liferay.portal:portal-service

Liferay Portal vulnerable to arbitrary command injection

org.apache.httpcomponents:httpclient

Hostname verification in Apache HttpClient 4.3 was disabled by default

mercurial

Mercurial vulnerable to arbitrary code injection