Open Source Vulnerabilities

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Vulnerable to Clickjacking

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins does not invalidate the API token when a user is deleted

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkin allows attackers to obtain passwords by reading the HTML source code

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows attackers to determine whether a user exists

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Denial of Service vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows attackers to obtain sensitive information

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins session fixation vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins cross-site scripting (XSS) vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Input During Web Page Generation in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs

org.jenkins-ci.main:jenkins-core

Jenkins improperly ensures trust separation

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows for Code Execution via Crafted Packet to the CLI

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins does not Restrict Reserved Names Allowing for Privilege Escalation

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows for Privilege Escalation by Remote Authenticated Users

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows Cross-Site Scripting (XSS)

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Cross-site Scripting vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins allows for Privilege Escalation by Remote Authenticated Users

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Vulnerable to Denial of Service (DoS)

com.liferay:com.liferay.portal.search.web

Liferay Portal Vulnerable to XSS in Profile Search Functionality

neutron

OpenStack Neutron Race condition vulnerability

org.jvnet.hudson.plugins:monitoring

Jenkins Monitoring Plugin Reveals Sensitive Information via Unspecified Pages

org.jenkins-ci.plugins:exclusion

Jenkins Exclusion Plugin allows Access to Resource Locks

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Cross-Site Request Forgery vulnerabilities

org.jvnet.hudson.plugins:monitoring

Jenkins Monitoring Plugin allows Cross-Site Scripting (XSS)

com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

Jenkins Build Failure Analyzer Plugin allows Cross-Site Scripting (XSS)

djblets, djblets

Djiblets Cross-site scripting Vulnerability via JSON Objects

librsvg

librsvg DoS via Cyclic References

requests

Exposure of Sensitive Information to an Unauthorized Actor in Requests

ajenti

Eugene Pankov Ajenti Cross-site scripting Vulnerabilities

org.jboss.resteasy:resteasy-client, org.jboss.resteasy:resteasy-client

Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

trytond, trytond, trytond, trytond, trytond

Tryton allows users to read the hashed password

murano, murano-dashboard, murano-dashboard, python-muranoclient, python-muranoclient

OpenStack Murano Code Execution

org.apache.jackrabbit:jackrabbit-webdav, org.apache.jackrabbit:jackrabbit-webdav, org.apache.jackrabbit:jackrabbit-webdav, org.apache.jackrabbit:jackrabbit-webdav, org.apache.jackrabbit:jackrabbit-webdav, org.apache.jackrabbit:jackrabbit-webdav

Apache Jackrabbit Authentication Hijacking Vulnerability

drupal/drupal, drupal/core

Drupal Users without "Administer comments" can set comment visibility on nodes they can edit

drupal/core, drupal/drupal

Drupal Cross-site scripting (XSS) vulnerability

drupal/core, drupal/drupal

Drupal Unprivileged access to config export

org.apache.tomcat:tomcat

Deserialization of Untrusted Data in Apache Tomcat

org.apache.activemq:activemq-core

Cross-site Scripting in Apache ActiveMQ

org.apache.activemq:apache-activemq, org.apache.activemq:activemq-web-demo

Apache ActiveMQ default configuration subject to denial of service

org.apache.activemq:activemq-core

Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet

oauth2

SimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces

oauth2

SimpleGeo python-oauth2 does not check the nonce allowing replay attacks

openid/php-openid, typo3/cms

PHP OpenID Library Denial of Service vulnerability

org.apache.activemq:activemq-client

Improper Authentication in Apache ActiveMQ

pywbem

PyWBEM TOCTOU vulnerability in certificate validation

pywbem

PyWBEM TOCTOU vulnerability in certificate validation

typo3/cms, typo3/cms, typo3/cms, typo3/cms

TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component