Open Source Vulnerabilities

october/october

October CMS XSS In Caption Tag of Profile

ckeditor/ckeditor

The Preview plugin in CKEditor allows Cross-site scripting (XSS)

mediawiki/core, mediawiki/core

Cross-site scripting vulnerability in includes/actions/InfoAction.php

swift

OpenStack Swift Cross-site Scriping vulnerability

org.apache.solr:solr-core

Improper Limitation of a Pathname to a Restricted Directory in Apache Solr

glance, glance

OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions

org.apache.ambari:ambari

Apache Ambari Open Redirect

org.apache.ambari:ambari

Apache Ambari SSRF Vulnerability

keystone

OpenStack Identity (Keystone) DoS through V3 API authentication chaining

smarty/smarty

Cross-site Scripting in SmartyException

plone, plone

Plone denial of service via Caching Bypass

ipsilon

Ipsilon denial of service via a duplicate SP name

jinja2

Insecure Temporary File in Jinja2

joomla/session

Joomla! Framework Remote Code Injection Vulnerability

typo3/cms, typo3/cms

TYPO3 Cross-site Scripting vulnerability

typo3/cms

TYPO3 CMS indexed search Cross-site Scripting vulnerability

typo3/cms

TYPO3 allows remote attackers to embed Flash videos from external domain

typo3/cms, typo3/cms

Typo3 XSS Vulnerability

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerabilities

org.apache.solr:solr-core

Improper Neutralization of Input During Web Page Generation in Apache Solr

org.apache.solr:solr-core

Improper Neutralization of Input During Web Page Generation in Apache Solr

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin cross-site scripting Vulnerability via ENUM value

drupal/drupal, drupal/drupal, drupal/drupal, drupal/core, drupal/core, drupal/core

Drupal Open Redirect

org.apache.ranger:ranger

Apache Ranger Cross-site Scripting vulnerability

drupal/core, drupal/drupal

Drupal CRLF injection vulnerability in the drupal_set_header function

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal saving user accounts can sometimes grant the user all roles

drupal/core, drupal/drupal

Drupal Form API ignores access restrictions on submit buttons

org.apache.ranger:ranger

Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs

org.apache.ranger:ranger

Apache Ranger allows users to bypass intended access restrictions via the REST API

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal Reflected file download vulnerability

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal sensitive information disclosure

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal Brute force amplification attacks via XML-RPC

tripleo-heat-templates

OpenStack TripleO Heat templates spoof metadata requests

org.apache.ranger:ranger

Apache Ranger Access Restriction Bypass

drupal/core, drupal/drupal

Drupal Open redirect vulnerability in the drupal_goto function

org.apache.portals.jetspeed-2:jetspeed

Path Traversal in Apache Jetspeed

org.apache.portals.jetspeed-2:jetspeed-commons

Apache Jetspeed vulnerable to Cross-site Scripting

org.apache.portals.jetspeed-2:jetspeed

Apache Jetspeed vulnerable to SQL Injection

roundup

Roundup sensitive data disclosure vulnerability

org.apache.portals.jetspeed-2:jetspeed

Cross-site Scripting in Apache Jetspeed

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal File upload access bypass and denial of service

tripleo-heat-templates

TripleO Heat templates might allow remote attackers to obtain sensitive information from private containers

org.owasp.esapi:esapi

Missing Cryptographic Step in OWASP Enterprise Security API for Java

drupal/core, drupal/drupal

Drupal arbitrary code execution

symfony/security-http, symfony/security-http, symfony/security-http, symfony/security-http, symfony/security, symfony/security, symfony/security, symfony/security, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony

Symphony Denial of Service Via Overlong Usernames

symfony/security-core, symfony/security-core, symfony/security, symfony/security, symfony/security, symfony/symfony, symfony/symfony, symfony/symfony

Symfony Cryptographic Vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Cross-Site Scripting (XSS)

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows attackers to execute arbitrary jobs

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Remote Attackers to Hijack Sessions

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows attackers to configure restricted projects