Open Source Vulnerabilities

org.directwebremoting:dwr, org.directwebremoting:dwr

Exposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting

typo3/cms, typo3/cms, typo3/cms

Typo3 Open Redirect In Frontend Rendering

keystonemiddleware, keystonemiddleware, python-keystoneclient, python-keystoneclient

OpenStack keystonemiddleware does not verify certificate

org.apache.hadoop:hadoop-common

Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

glance, glance

OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service

glance

OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file

doctrine/annotations, doctrine/cache, doctrine/common, doctrine/common, doctrine/orm, doctrine/mongodb-odm, doctrine/mongodb-odm-bundle, zendframework/zendframework1, zendframework/zend-cache, aws/aws-sdk-php, doctrine/cache, zendframework/zend-cache, zendframework/zendframework, zfcampus/zf-apigility-doctrine

Doctrine Security Misconfiguration Vulnerability

zendframework/zendframework1

Zend Framework SQL injection vector using null byte for PDO

glance

OpenStack Image Service (Glance) vulnerable to Improper Access Control

radicale

Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin Cryptographic Vulnerability

django

Django Access Restrictions Bypass

org.apache.struts:struts2-core

Apache Struts XSS Vulnerability

org.apache.struts:struts2-core, org.apache.struts:struts2-core, org.apache.struts:struts2-core

Remote Code Execution in Apache Struts

org.apache.struts:struts2-core, ognl:ognl

Denial of service in Apache Struts

keystone

OpenStack Identity Keystone Improper Access Control

neutron, neutron

OpenStack Neutron Intended MAC-spoofing protection mechanism bypass

drupal/core, drupal/drupal

Drupal Views can allow unauthorized users to see Statistics information

drupal/core, drupal/drupal

Drupal Saving user accounts can sometimes grant the user all roles

jwcrypto

jwcrypto lacks the Random Filling protection mechanism

drupal/core, drupal/drupal

Drupal Denial of service via transliterate mechanism

moodle/moodle

Moodle Unrestricted file upload vulnerability

moodle/moodle

Moodle XSS Vulnerability

drupal/core, drupal/drupal

Drupal Incorrect cache context on password reset page

org.opensaml:opensaml, edu.internet2.middleware:shibboleth-identityprovider

Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

org.apache.hadoop:hadoop-common, org.apache.hadoop:hadoop-common

Improper Access Control in Apache Hadoop

mediaelement, contao-components/mediaelement, contao/core

MediaElement Vulnerable to Reflected XSS

slim/slim

Slim vulnerable to PHP object injection

django, django

Django Cross-site Scripting Vulnerability

symfony/symfony, symfony/symfony, symfony/symfony, symfony/http-kernel, symfony/http-kernel, symfony/http-kernel

Symfony Vulnerable to PHP Eval Injection

ceph-deploy

ceph-deploy allows local users to obtain sensitive information by reading the file

swift

OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service

phpmyadmin/phpmyadmin

phpMyAdmin Cross-site scripting (XSS) vulnerability in SQL parser

phpmyadmin/phpmyadmin

phpMyAdmin Improper Input Validation

yiisoft/yii2

Yii Framework Cross-site Scripting Vulnerability

dolibarr/dolibarr

Dolibarr ERP and CRM contain Cross-site Scripting Vulnerability

django

Django allows user sessions hijacking via an empty string in the session key

concrete5/concrete5

concrete5 vulnerable to Cross-site Scripting

radicale

Radicale regex metacharacters injection in the user name

swift, swift

OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service

radicale

Radicale vulnerable to arbitrary file read or write

org.elasticsearch:elasticsearch

Elasticsearch Improper Access Control vulnerability

org.restlet.jse:org.restlet

Restlet Arbitrary Java Code Execution via a serialized object

org.springframework:spring, org.springframework:spring

Improper Control of Generation of Code ('Code Injection') in Spring Framework

glance

OpenStack Glance Bypass the storage quota and Denial of service

org.apache.struts:struts2-core, org.apache.struts:struts2-rest-plugin

Code injection in Apache Struts

org.restlet.jse:org.restlet

Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML

ipsilon, ipsilon

Ipsilon denial of service by deleting a SAML2 Service Provider (SP)

notebook, ipython

Improper Input Validation in Jupyter Notebook

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin allows remote attackers to spoof content via the url parameter