Open Source Vulnerabilities

org.apache.hadoop:hadoop-client

Improper Input Validation in Apache Hadoop

org.apache.hadoop:hadoop-client

Improper Neutralization of Input During Web Page Generation in Apache Hadoop

baserproject/basercms

baserCMS Access Control Bypass

baserproject/basercms

BaserCMS privilege escallation

qpid-python

Apache Qpid Python client Improper certificate validation

concrete5/concrete5

Concrete CMS vulnerable to cross-site scripting (XSS)

node-inspector

Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding

org.apache.zookeeper:zookeeper, org.apache.zookeeper:zookeeper

Uncontrolled Resource Consumption in Apache ZooKeeper

irisnet-crypto

irisnet-crypto RCE Vulnerability

matrix-synapse

Matrix Synapse Predictable Secret Key

com.nablarch.framework:nablarch-fw-web

Nablarch Incomplete Cryptography

nnabla

Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10

contao/contao, contao/core-bundle

Contao Does Not Expire Tokens Correctly

hex_core

Hex authenticity of signed packages not validated

bootstrap, bootstrap, bootstrap, bootstrap, org.webjars:bootstrap, org.webjars:bootstrap, bootstrap, bootstrap, bootstrap.sass, bootstrap-sass, twbs/bootstrap, twbs/bootstrap

Bootstrap vulnerable to Cross-Site Scripting (XSS)

org.apache.xmlgraphics:fop

Improper Restriction of XML External Entity Reference in Apache FOP

ezyang/htmlpurifier

HTML Purifier cross-site scripting (XSS) vulnerability

github.com/traefik/traefik

Traefik Missing Authentication

org.apache.geronimo:geronimo

Apache Geronimo Hash Collisions Cause DoS

fluentd

Fluentd Escape Sequence Injection Vulnerability

ansible, ansible, ansible

Ansible Arbitrary Code Execution

horizon, horizon

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

ironic, ironic

OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

ansible, ansible, ansible

Ansible Improper Input Validation vulnerability

neutron, neutron, neutron, neutron

OpenStack Neutron's unsupported dport option prevents applying security groups

ansible, ansible, ansible

Ansible sensitive information disclosure

neutron, neutron, neutron

OpenStack Neutron overlapping security group rules prevents compute node network configuration

octavia, octavia

Openstack Octavia allows Insertion of Sensitive Information into Log File

instack-undercloud

instack-undercloud vulnerable to symlink attack on tmp files

ansible

Ansible Arbitrary Code Execution

neutron, neutron, neutron

OpensStack Neutron Denial of Service Vulnerability

neutron, neutron, neutron, neutron

OpenStack Neutron Race Condition vulnerability

keystone, keystone, keystone

OpenStack Identity service (keystone) Incorrect Authorization

manila-ui

Openstack Manila Persistent XSS in Metadata field

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry vulnerable to Cross-Site Request Forgery

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA Identity Zone Admin Privilege Escalation

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA password reset vulnerability

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Blind SQL Injection with privileged Cloud Foundry UAA endpoints

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA privilege escalation with user invitations

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA Privilege Escalation

org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA reset password vulnerable to brute force attack

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry denial of service vulnerability

org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core

Apache Directory Studio Command Injection

Microsoft.NETCore.Jit, Microsoft.NETCore.Jit, Microsoft.NETCore.Jit

.NET Core Denial of Service Vulnerability

org.apache.commons:commons-compress

Uncontrolled Resource Consumption in Apache Commons Compress

io.pivotal.spring.cloud:spring-cloud-sso-connector

Issuer validation regression in Spring Cloud SSO Connector

org.springframework.integration:spring-integration-zip

spring-integration-zip Arbitrary File Write

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

UAA privilege escalation across identity zones

org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password

org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password