Open Source Vulnerabilities

nova

OpenStack Nova VMWare driver leaks rescued images

org.apache.geronimo.framework:geronimo-jmx-remoting

Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1

MongooseIM

Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream

reviewboard, reviewboard

Review Board Cross-site scripting (XSS) vulnerability in the reviews dropdown

pimcore/pimcore

Pimcore Vulnerable to PHP Object Injection Attacks

org.fitnesse:fitnesse

Improper Neutralization of Special Elements used in a Command in FitNesse Wiki

pillow

Pillow command injection

ajenti

Ajenti Cross-site scripting (XSS) vulnerability

transifex-client

Transifex command-line client has improper certificate validation

python-keystoneclient

OpenStack Nova uses insecure keystone middleware tmpdir by default

keystone

OpenStack Keystone Sensitive information disclosure via log files

org.apache.struts:struts2-core

Apache Struts2 Broken Access Control Vulnerability

org.igniterealtime.openfire:parent

Ignite Realtime Openfire vulnerable to XMPPbomb attack

org.jenkins-ci.plugins:subversion

Jenkins Subversion Plugin Stores Credentials with Base64 Encoding

kafo, kafo

Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml

soappy

SOAPpy vulnerable to XXE attacks

soappy

SOAPpy vulnerable to XML External Entity attacks

gitlab-grit

GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed

typo3/cms, typo3/cms, typo3/cms

Typo3 Backend History Module Vulnerable to XSS

typo3/cms, typo3/cms

TYPO3 vulnerable to remote authenticated arbitrary code execution

typo3/cms-core, typo3/cms-core

TYPO3 Improper Access Management in the File Abstraction Layer

typo3/cms, typo3/cms

TYPO3 doesn't properly check file extensions

typo3/cms

Typo3 Information Disclosure

typo3/cms

TYPO3 Improper Session Invalidation

typo3/cms

TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash

phpoffice/phpexcel

PHPExcel vulnerable to XXE attacks through libxml

glance

OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability

sabre/dav, sabre/dav

XXE in SabreDAV

neutron

OpenStack Neutron Improper Authentication vulnerability

geshi/geshi

GeSHi vulnerable to Cross-site Scripting

impresscms/impresscms

ImpressCMS Cross-site scripting Vulnerability

geshi/geshi

GeSHi vulnerable to Directory Traversal

djblets, djblets

Djblets Cross-site scripting Vulnerability

mayan-edms

Mayan EDMS multiple cross-site scripting (XSS) vulnerabilities

nova

OpenStack Nova denial of service through compressed disk images

nova

OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests

nova

OpenStack Compute (Nova) Denial of service due to improper validation of virtual size of QCOW2 image

nova

OpenStack Nova host data leak to vm instance in rescue mode

plone, products-cmfplone

Plone Filesystem path information leak

plone, products-cmfplone

Plone Privilege escalation through exposed underlying API

org.apache.solr:solr-core

XML Injection in Apache Solr

org.apache.solr:solr-core

Apache Solr UpdateRequestHandler for XML resolves XML External Entities

jplayer

jplayer Cross Site Scripting vulnerability

yiisoft/yii

Yii PHP Framework arbitrary PHP scripts execution

org.neo4j:neo4j

Neo4J vulnerable to Cross-Site Request Forgery

fat_free_crm

Fat Free CRM subject to Cross-site Scripting

plone, plone

Plone Information Disclosure

plone, plone

Plone Metadata Disclosure

plone, plone

Plone Sandbox Bypass

plone, plone

Plone Cross-site scripting Vulnerability