Open Source Vulnerabilities

salt

Salt has insufficient argument validation in several modules

phpmyadmin/phpmyadmin

phpMyAdmin Remote Code Execution

trytond

Tryton Directory Traversal vulnerability

org.apache.struts:struts2-core

Apache Struts is vulnerable to Cross-site Scripting

keystone

OpenStack Keystone Improper Authentication vulnerability

zendframework/zendframework1, zendframework/zendframework1

Zend Framework XXE Vulnerability

django, django

Django Directory Traversal via ssi template tag

sup, sup

Sup Code Injection vulnerability

pyopenssl

PyOpenSSL Mishandles NUL Byte In Certificate Subject Alternative Name

drupal/drupal

Drupal Open Redirect

drupal/drupal

Drupal improper access restrictions

moin

MoinMoin Multiple unrestricted file upload vulnerabilities

org.jenkins-ci.plugins:sonar

Jenkins SonarQube Plugin Stores Passwords in Cleartext

fat_free_crm

Fat Free CRM allows remote attackers to obtain sensitive information via a direct request

fat_free_crm

Fat Free CRM vulnerable to SQL Injection

fat_free_crm

Fat Free CRM vulnerable to Exposure of Sensitive Information

fat_free_crm

Fat Free CRM has fixed token value

fat_free_crm

Fat Free CRM contains Cross-site Request Forgery vulnerablilities

drupal/drupal

Drupal has open redirect vulnerability in the Overlay module

nova

OpenStack Compute (Nova) does not verify the virtual size of a QCOW2 image

rubygems-update

RubyGems HTTPS to HTTP redirect

rubygems-update

RubyGems does not verify SSL certificate

typo3/cms, typo3/cms, typo3/cms, typo3/cms

TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component

typo3/cms-core, typo3/cms-core, typo3/cms-core, typo3/cms-core

TYPO3 Improper Access Control vulnerability

typo3/cms-core, typo3/cms-core, typo3/cms-core

TYPO3 is vulnerable to Mass Assignment in the Extension table administration library

python-keystoneclient

python-keystoneclient missing expiration check in PKI token validation

ec-cube/ec-cube

EC-CUBE vulnerable to authorization bypass

django, django

Django Denial of Service Vulnerability in the authentication framework

com.smartbear.soapui:soapui

Code injection via property expansion in SoapUI

python-swiftclient

Python Swift client is vulnerable to Missing SSL Certificate Check

civicrm/civicrm-core, civicrm/civicrm-core

CiviCRM SQL injection vulnerability via Quick Search API

keystone

OpenStack Identity Keystone Privilege Escalation vulnerability

org.apache.solr:solr-core

Improper Restriction of XML External Entity Reference in Apache Solr

org.jgroups:jgroups, org.jgroups:jgroups

Exposure of Sensitive Information to an Unauthorized Actor in JGroup

nova

OpenStack Nova Router metadata queries are not restricted by tenant

glance

OpenStack Glance sensitive information disclosure via logs

swift, swift, swift

OpenStack Swift Discloses Secret URLs to Timing Attack

plone, plone, plone

Plone Authenticated Denial of Service vulnerability

plone, plone, plone

Plone Privilege escalation due improper authorization

plone, plone, plone

Plone Denial of Service vulnerability via decompressing large zip archives

plone, plone, plone

Plone is vulnerable to information exposure via the object manager implementation

plone, plone, plone

Plone's authenticated users able to alter their password despite of policy definition

plone, plone, plone

Plone vulnerable to cross-site scripting

plone, plone, plone

Plone is vulnerable to email spoofing

plone, plone, plone

Plone is vulnerable to Information Exposure when generating zip archives

plone, plone, plone

Plone is vulnerable to File System Path Exposure

plone, plone, plone

Plone Unrestricted Filed Manipulation vulnerability via content edit forms

DotNetNuke.Core, DotNetNuke.Core

DotNetNuke (DNN) Open redirect vulnerability

plone, plone, plone

Plone Multiple open redirect vulnerabilities

plone, plone, plone

Plone Improper Access Control Vulnerability