Open Source Vulnerabilities

yarn

TOCTOU Race Condition in Yarn

mout

Prototype Pollution in mout

ua-parser-js

ua-parser-js Regular Expression Denial of Service vulnerability

js-data

Prototype Pollution in js-data

org.apache.dolphinscheduler:dolphinscheduler

Remote code execution in DolphinScheduler

org.apache.tomee:apache-tomee, org.apache.tomee:apache-tomee, org.apache.tomee:apache-tomee

Remote code execution in Apache TomEE

yarn

Path Traversal in Yarn

jsrsasign

Signatures are mistakenly recognized to be valid in jsrsasign

org.apache.accumulo:accumulo-master, org.apache.accumulo:accumulo-master

Improper privilege handling in Apache Accumulo

com.twitter:twitter-server_2.12

TwitterServer Cross-site Scripting via /histograms endpoint

org.wso2.transport.http:org.wso2.transport.http.netty

HTTP Response Splitting in WSO2 transport-http

undefsafe

Prototype Pollution in undefsafe

dot-object

Prototype Pollution in dot-object

org.xwiki.platform:xwiki-platform-web

Improper escaping in XWiki Platform

de.tum.in.ase:artemis-java-test-sandbox

Class Loading Vulnerability in Artemis

org.apache.flink:flink-runtime

Upload of file to arbitrary path in Apache Flink

engine.io

Resource exhaustion in engine.io

github.com/netlify/gotrue

User object created with invalid provider data in GoTrue

org.apache.dubbo:dubbo-parent, org.apache.dubbo:dubbo-parent

Deserialization exploitation in Apache Dubbo

org.apache.dolphinscheduler:dolphinscheduler-api

Incorrect Default Permissions in Apache DolphinScheduler

org.netbeans.html:pom

Improper synchronization in Apache Netbeans HTML/Java API

node-sass

Improper Certificate Validation in node-sass

superjson, blitz

Prototype Pollution leading to Remote Code Execution in superjson

org.eclipse.hawkbit:hawkbit-parent

Cross-site Scripting in Eclipse Hawkbit

org.apache.servicecomb:java-chassis, org.apache.servicecomb:java-chassis

Arbitrary code execution in Apache ServiceComb java-chassis

net.mingsoft:ms-mcms

SQL injection without credentials in ming-soft MCMS

org.apache.hadoop:hadoop-common, org.apache.hadoop:hadoop-common, org.apache.hadoop:hadoop-common

Improper Privilege Management in Apache Hadoop

github.com/open-policy-agent/opa

Incorrect Calculation in github.com/open-policy-agent/opa

org.springframework.cloud:spring-cloud-task-dependencies

SQL Injection in Spring Cloud Task

org.apache.activemq:activemq-parent

Improper Authentication in Apache ActiveMQ

org.apache.activemq:activemq-parent

Remote code execution in Apache ActiveMQ

org.apache.activemq:apache-artemis

Cross-site Scripting (XSS) in Apache ActiveMQ Artemis

org.apache.druid:druid

Credentials bypass in Apache Druid

org.apache.shiro:shiro-web, org.apache.shiro:shiro-spring, org.apache.shiro:shiro-spring-boot-starter

Authentication bypass in Apache Shiro

org.apache.activemq:activemq-parent, org.apache.activemq:activemq-parent

Cross-site scripting (XSS) in Apache ActiveMQ

ansible

Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible

ansible, ansible, ansible

Argument Injection in Ansible

ansible

Incorrect Permission Assignment for Critical Resource in Ansible

ansible, ansible

Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible

ansible, ansible, ansible

Insertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansible

org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-oldcore

Missing authorization in xwiki-platform

Prototype Pollution leading to Remote Code Execution in superjson