Open Source Vulnerabilities

plone, plone

Plone Cross-site scripting Vulnerability

plone, plone

Plone Arbitrary File Read

plone, plone

Plone Sandbox Bypass

plone, plone

Plone Cross-site scripting Vulnerability

plone, plone

Plone Cross-site scripting Vulnerability

plone, plone

Plone Information Disclosure

plone

Plone DoS via Crafted URL

plone, plone

Plone denial of service via RSS Feed Request

plone, plone

Plone python code injection

dl/yag, punktde/pt_extbase

yag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions

web-tp3/wec_map, jbartels/wec-map

WEC Map (wec_map) extension for TYPO3 allows SQL Injection

web-tp3/wec_map, jbartels/wec-map

WEC Map (wec_map) extension for TYPO3 allows Cross-site Scripting

org.jolokia:jolokia-core

Cross-Site Request Forgery in Jolokia

plone, plone

Plone Code Injection vulnerability

plone, plone

Plone Code Injection vulnerability

plone, plone

Plone is vulnerable to denial of service

plone, plone

Plone User account enumeration via crafted URL

keystone

OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

in2code/powermail

TYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism

in2code/powermail, in2code/powermail

TYPO3 powermail extension has unrestricted file upload vulnerability

keystone

OpenStack Keystone Domain-scoped tokens don't get revoked

keystone

OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events

cobbler

Cobbler vulnerable to code injection via unsafe YAML loading

plone, plone

Plone contains Cross-site Request Forgery

plone, plone

Exposure of Sensitive Information in Plone

cinder

OpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability

org.directwebremoting:dwr, org.directwebremoting:dwr

Improper Neutralization of Input During Web Page Generation in Direct Web Remoting

org.apache.hadoop:hadoop-client, org.apache.hadoop:hadoop-client

Improper Link Resolution Before File Access in Apache Hadoop

bottle, bottle, bottle

Bottle does not properly limit content-types

phpmyadmin/phpmyadmin

phpMyAdmin Multiple XSS Vulnerabilities After Inline Editing and Save

phpmyadmin/phpmyadmin

phpMyAdmin Multiple XSS Vulnerabilities

james-heinrich/phpthumb

phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony, symfony/polyfill, symfony/security, symfony/security, symfony/security, symfony/security

Symfony Denial of Service Via Long Password Hashing

typo3/cms, typo3/cms, typo3/cms, typo3/cms, typo3/cms, typo3/cms, typo3/cms

Typo3 Vulnerable to Cache Poisoning

org.apache.solr:solr

Improper Neutralization of Input During Web Page Generation in Apache Solr

zf-commons/zfc-user

ZF-Commons ZfcUser Vulnerable to XSS in Login Redirect

org.jruby:jruby-parent

JRuby denial of service via Hash Collision

org.fusesource.hawtjni:hawtjni-runtime

Improper Control of Generation of Code in HawtJNI

io.undertow:undertow-core, io.undertow:undertow-core, io.undertow:undertow-core

Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow

dulwich

Dulwich Buffer Overflow when handling pack files

dulwich

Dulwich Arbitrary code execution via commit with directory path starting with .git

keystone

OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend

org.jboss.resteasy:resteasy-jaxrs

XML External Entity Reference in RESTEasy

django-markupfield

django-markupfield Arbitrary File Read

org.drools:drools-core, org.jbpm:jbpm-bpmn2

Improper Input Validation in Drools and jBPM

org.elasticsearch:elasticsearch, org.elasticsearch:elasticsearch

Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

ceph-deploy

ceph-deploy uses world-readable permissions on client.admin key

impresscms/impresscms

ImpressCMS Path Traversal to Arbitrary File Delete

org.picketlink:picketlink-tomcat-common

PicketLink does not properly check role based authorization

drupal/core

Drupal Access Control Bypass