Open Source Vulnerabilities

matrix-react-sdk

Improper file handling in matrix-react-sdk

vmd

Cross-site Scripting in vmd

node-key-sender

OS Command Injection in node-key-sender

effect

Withdrawn Advisory: OS Command Injection in effect

op-browser

Injection in op-browser

karma-mojo

karma-mojo enables OS Command Injection

aurelia-framework

Cross-site Scripting in aurelia-framework

@rkesters/gnuplot

Code injection in @rkesters/gnuplot

jscover

OS Command Injection in jscover

strong-nginx-controller

OS Command Injection in strong-nginx-controller

express-handlebars

Insecure template handling in Express-handlebars

chownr

Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

froala-editor

DOM-based cross-site scripting in Froala Editor

ajv

Prototype Pollution in Ajv

bson

Deserialization of Untrusted Data in bson

org.apache.tomee:tomee, org.apache.tomee:tomee, org.apache.tomee:tomee, org.apache.tomee:tomee

Missing Authentication for Critical Function in Apache TomEE

com.netflix.conductor:conductor-core

Expression Language Injection in Netflix Conductor

org.apache.archiva:archiva

Injection in Apache Archiva

org.apache.spark:spark-parent_2.11, pyspark

Improper Authentication in Apache Spark

org.hibernate:hibernate-core, org.hibernate:hibernate-core, org.hibernate:hibernate-core

SQL Injection in Hibernate ORM

org.apache.karaf.management:org.apache.karaf.management.server

Server-Side Request Forgery in Karaf

com.mikesamuel:json-sanitizer

Cross-site scripting in json-sanitizer

org.jodd:jodd-json

Deserialization of Untrusted Data in Jodd

net.minidev:json-smart, net.minidev:json-smart

Out of bounds read in json-smart

org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-tool-configuration-resources, org.xwiki.platform:xwiki-platform-tool-configuration-resources

Cross-site Scripting by SVG upload in xwiki-platform

org.xwiki.platform:xwiki-platform-administration-ui, org.xwiki.platform:xwiki-platform-administration-ui

Cross-Site Request Forgery in xwiki-platform

org.graylog:graylog-parent

Improper Certificate Validation in Graylog

org.apache.dubbo:dubbo, org.apache.dubbo:dubbo-common

Deserialization of Untrusted Data in Apache Dubbo

org.apache.cxf:cxf-rt-management, org.apache.cxf:cxf-rt-management

Apache CXF JMX Integration is vulnerable to a MITM attack

coherence

Permissive parameters and privilege escalation

terminal42/contao-tablelookupwizard

Possible SQL injection in tablelookupwizard Contao Extension

forkcms/forkcms

Cross-site scripting in forkcms

concrete5/concrete5

Unrestricted Uploads in Concrete5

cakephp/cakephp, cakephp/cakephp

Cross-Site Request Forgery in CakePHP

francoisjacquet/rosariosis

Cross-site Scripting in RosarioSIS

microweber/microweber

Zip slip in Microweber

twig/twig, twig/twig

Code injection in Twig

vim, vim, vim

vim

CVE-2022-0554 affecting package vim for versions less than 8.2.4743-1

CVE-2022-0554 does not affect BellSoft software

vim, vim, vim, vim, vim

com.taoensso:nippy

Gadget chain attack in Nippy

org.apache.deltaspike:deltaspike

Injection in DeltaSpike

org.apache.atlas:apache-atlas

Cross-site scripting in Apache Atlas

org.apache.geode:geode-core

Apache Geode SSL endpoint verification vulnerability