Open Source Vulnerabilities

Unrestructed file upload in yetiforcecompany/yetiforcecrm

sqlite3, sqlite3

sqlite3 vulnerability

Server-Side Request Forgery in scout in clinical-genomics/scout

mysql-8.0, mysql-8.0

mysql-8.0 regression

Security Beta update for SUSE Manager Client Tools

Bludit New Content Module new-content cross site scripting

apache-jena, apache-jena, apache-jena

apache-jena, apache-jena, apache-jena, apache-jena

twisted, twisted, twisted

twisted vulnerability

nova

OpenStack Compute Nova Unauthorised access to arbitrary VM using VNC token from deleted VM

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Remote Users to Build Arbitrary Jobs

bundler

Bundler may install gems from a different source than expected

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Vulnerable to Denial of Service (DoS) via Crafted Payload

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Cross-Site Request Forgery vulnerability

org.jenkins-ci.main:jenkins-core

Jenkins subject to Cross-site Scripting

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Cross-Site Request Forgery vulnerability

django, django

Django Data leakage via admin history log

django, django

Django is vulnerable to Denial of Service attack in formset

keystone

OpenStack Keystone allows context-dependent attackers to bypass access restrictions

keystone

OpenStack Keystone Denial of Service vulnerability via a large HTTP request

rack, rack, rack, rack, rack

Rack arbitrary code execution via timing attack

commons-fileupload:commons-fileupload

Incorrect Default Permissions in Apache Commons FileUpload

org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-frontend-jaxrs

Improper Authentication in Apache CXF

glance

OpenStack Glance logs user name and password in cleartext

rack, rack, rack, rack

Rack vulnerable to Denial of Service

ruby_parser

ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows attackers to obtain the master cryptographic key

beaker

Deserialization of Untrusted Data in Beaker

prestashop/prestashop

PrestaShop Stored Cross-Site Scripting Vulnerability

pdfkit

PDFKit Improper Input Validation vulnerability

pyrad

pyrad is vulnerable to the use of Insufficiently Random Values

org.springframework:spring-web

Improper Neutralization of Input During Web Page Generation in Spring Framework

symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony, symfony/http-foundation, symfony/http-foundation, symfony/http-foundation, symfony/http-foundation

Symfony Host Header Injection vulnerability in the HttpFoundation component

plone, plone, plone, plone

Plone Zope cross-site scripting (XSS) vulnerability

features

Features file injection vulnerability

connect

Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware

omniauth-facebook

omniauth-facebook Improper Authentication vulnerability

openshift-origin-controller

RubyGem openshift-origin-controller is vulnerable to command injection

pyrad

pyrad uses sequential packet IDs

salt

SaltStack RSA Key Generation allows remote users to decrypt communications

nokogiri, nokogiri

Nokogiri vulnerable to DoS while parsing XML documents

nokogiri, nokogiri

Nokogiri vulnerable to DoS while parsing XML entities

djblets, djblets, reviewboard

ReviewBoard and Djblets library are vulnerable to code execution

scipy

SciPy creates insecure temporary directories

symfony/validator, symfony/validator, symfony/validator, symfony/validator, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony

Symfony collectionCascaded and collectionCascadedDeeply fields security bypass

python-keystoneclient, cinder, neutron, keystone

OpenStack Keystone and other components vulnerable to Improper Certificate Validation

microweber/microweber

Microweber vulnerable to cross-site scripting (XSS)

facturascripts/facturascripts

Cross-site Scripting in FacturaScripts