Open Source Vulnerabilities

cakephp/cakephp

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file

spree

Spree does not properly restrict the use of a hash to provide values for a model's attributes

spree

Spree uses a hardcoded hash value

dompdf/dompdf

DOMPDF Remote File Inclusion Vulnerability

roundup

Roundup Cross-site Scripting (XSS) vulnerability

typo3/cms, typo3/cms, typo3/cms

TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism

org.apache.sling:org.apache.sling.servlets.post

Apache Sling POST Servlets Denial of Service Vulnerability

cobbler

Cobbler subject to Command Injection

chef

Chef Improper Access Control vulnerability

nova

OpenStack Nova Arbitrary file injection/corruption through directory traversal issues

nova

OpenStack Nova Directory traversal vulnerability

phpmyadmin/phpmyadmin

phpMyAdmin Multiple XSS Vulnerabilities

nova

OpenStack Nova Scheduler denial of service through scheduler_hints

elixir

Elixir can leak information due to weak use of crypto

com.caucho:resin

Caucho Quercus, as distributed in Resin, does not properly implement the `==` operator for comparisons

com.caucho:resin

Caucho Quercus, as distributed in Resin, overwrites entries in SERVER superglobal array on basis of POST parameters

com.caucho:resin

Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables

tornado

Tornado CRLF injection vulnerability

typo3/cms, typo3/cms, typo3/cms

Typo3 Backend XSS Vulnerabilities

typo3/cms, typo3/cms, typo3/cms

TYPO3 allows remote attackers to obtain the database name via a direct request

typo3/cms, typo3/cms, typo3/cms

Typo3 API XSS Vulnerabilities

typo3/cms, typo3/cms, typo3/cms

Typo3 Extbase Framework Unsafe Deserialization

keystone

OpenStack Keystone token expiration issues

keystone

OpenStack Keystone Allows Remote User Account Creation

beaker

Beaker Sensitive Information Disclosure vulnerability

silverstripe/framework, silverstripe/framework

Silverstripe XSS Vulnerabilities

silverstripe/cms

Silverstripe CMS Arbitrary Code Execution

impresspages/impresspages

ImpressPages CMS eval injection vulnerability

org.postgresql:postgresql

Unescaped parameters in the PostgreSQL JDBC driver

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin Vulnerable to Cross-Site Scripting

apache-libcloud

Apache Libcloud vulnerable to certificate impersonation

phpmyadmin/phpmyadmin

phpMyAdmin vulnerable to Cross-site Scripting

org.jboss.mod_cluster:mod_cluster

Improper Access Control in JBoss mod_cluster

com.dotcms:dotcms

dotCMS allows remote authenticated users to execute arbitrary Java code

keyring

Python Keyring does not securely initialize encryption cipher

org.springframework.security:spring-security-core, org.springframework.security:spring-security-core

Improper Control of Generation of Code in Spring Security

symfony/symfony, symfony/symfony, symfony/symfony

Symfony Access Control Vulnerability

org.springframework.security:spring-security-core, org.springframework.security:spring-security-core, org.springframework.security:spring-security-core

Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

moin

MoinMoin Directory Traversal vulnerability

moin

MoinMoin Multiple vulnerable to directory traversal

symfony/http-foundation, symfony/routing, symfony/security, symfony/symfony

Symfony Allows URI Restrictions Bypass Via Double-Encoded String

moin

MoinMoin Cross-site scripting (XSS) vulnerability

org.jboss.ironjacamar:ironjacamar-jdbc

User confusion in IronJacamar

phpmyadmin/phpmyadmin

phpMyAdmin Unsafe Fetching of Javascript Code

phpmyadmin/phpmyadmin

phpMyAdmin multiple cross-site scripting vulnerabilities

org.apache.axis2:axis2

Apache Axis2 Vulnerable to XML Signature wrapping attack

nova

OpenStack Nova Information leak in libvirt LVM-backed instances

org.openid4java:openid4java

OpenID4Java does not verify that Attribute Exchange (AX) information is signed

zendframework/zendframework1, zendframework/zendframework1

Zend Framework XEE Vulnerability

spree_auth_devise

spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles