Open Source Vulnerabilities

org.apache.qpid:qpid-client

Improper Authentication in Apache Qpid

katello, katello

Katello uses hard coded credential

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page

pastescript, paste

Paste Script has improper group memberships permissions

django, django

Django Image Field Vulnerable to Image Decompression Bombs

django, django

Django vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

django, django

Django Allows Redirect via Data URL

moin

MoinMoin Improper Access Control

zendframework/zendframework1, zendframework/zendframework1

Zend Framework XXE Vulnerability

zendframework/zendframework1, zendframework/zendframework1

Zend Framework XEE Vulnerability

django, django

Django Allows Arbitrary URL Generation

django, django

XML Entity Expansion (XEE) in Django

django, django

XML External Entity (XXE) in Django

typo3/cms-core, typo3/cms-core, typo3/cms-core, typo3/cms-core

TYPO3 SQL injection vulnerability in the Extbase Framework

typo3/cms-core, typo3/cms-core, typo3/cms-core, typo3/cms-core

TYPO3 Open redirect vulnerability in the Access tracking mechanism

org.apache.rave:rave-core, org.apache.rave:rave-web, org.apache.rave:rave-portal-resources

Apache Rave information disclosure vulnerability

phpmyadmin/phpmyadmin

phpMyAdmin Global variables scope injection vulnerability

net.liftweb:lift-webkit, net.liftweb:lift-webkit_2.7.7, net.liftweb:lift-webkit_2.8.0, net.liftweb:lift-webkit_2.8.1, net.liftweb:lift-webkit_2.8.2, net.liftweb:lift-webkit_2.9.0, net.liftweb:lift-webkit_2.9.0-1, net.liftweb:lift-webkit_2.9.1

Lift Sensitive Information Disclosure

cakephp/cakephp, cakephp/cakephp

CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references

phpmyadmin/phpmyadmin

phpMyAdmin Multiple cross-site scripting (XSS) vulnerabilities

org.opencms:opencms-core

Alkacon OpenCMS XSS via title and requestedResource parameters

egroupware/egroupware, egroupware/egroupware, egroupware/egroupware

EGroupware Code Injection vulnerability

rack-cache

Rack-Cache caches sensitive headers

org.jclouds.api:eucalyptus

Eucalyptus Unauthorized Access to CC/NC Log Files

nova

OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors

pyshop

pyshop vulnerable to man-in-the-middle attacks due to using HTTP to retrieve packages from the PyPI repository

graphite-web

graphite-web is vulnerable to Remote Code Execution

graphite-web

graphite-web is vulnerable to Remote Code Execution via renderLocalView function

net.bull.javamelody:javamelody-core

Improper Neutralization of Input During Web Page Generation in JavaMelody

org.opensaml:opensaml, org.opensaml:opensaml

Improper Authentication in OpenSAML

setuptools

Setuptools vulnerable to Man-in-the-middle attacks

bvbmedia/multishop

Multishop extension for TYPO3 has SQL Injection vulnerability

friendsofsymfony/user-bundle, friendsofsymfony/user-bundle

FriendsOfSymfony FOSUserBundle denial of service via login form

org.springframework.security:spring-security-core, org.springframework.security:spring-security-core

Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

org.apache.shindig:shindig-php

Apache Shindig PHP Sensitive Information Disclosure

org.apache.sling:org.apache.sling.auth.core

Apache Sling Auth Core bundle vulnerable to Open Redirection

pycrypto

PyCrypto does not properly reseed PRNG before allowing access

rack, rack, rack, org.jruby:jruby-parent

Rack Gem Subject to Denial of Service via Hash Collisions

swift

OpenStack Swift allows authenticated users to cause a denial of service

cinder

OpenStack Cinder LVMVolumeDriver does not zero deleted snapshots

nova

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

keystone

OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token

apache-solr-for-typo3/solr

Apache Solr for TYPO3 (solr) extension is vulnerable to Cross-site scripting (XSS)

apache-solr-for-typo3/solr

Apache Solr for TYPO3 (solr) extension is vulnerable to Insecure Unserialize

salt

SaltStack Privilege Escalation vulnerability

tikiwiki/tiki-manager, tikiwiki/tiki-manager, tikiwiki/tiki-manager, tikiwiki/tiki-manager

Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability

nova

OpenStack Compute Nova Improper Access Control

salt

Minion identity not validated in saltstack

salt

SaltStack insecurely uses /tmp

salt

SaltStack MITM SSH attack in salt-ssh