Open Source Vulnerabilities

plone, plone

Plone XSS in Zope ZMI

org.apache.poi:poi

Loop with Unreachable Exit Condition in Apache POI

openpyxl

Improper Restriction of XML External Entity Reference in Openpyxl

flask-oidc

flask-oidc Open Redirect vulnerability

mantisbt/mantisbt, mantisbt/mantisbt

MantisBT XSS through weak CSP when using Gravatar plugin

html5lib

Improper Neutralization of Input During Web Page Generation in html5lib

html5lib

Cross-site Scripting in html5lib

froxlor/froxlor

Froxlor guessable password reset token

plone, plone

Plone vulnerable to unauthorized disclosure of site content

plone, plone, plone

Plone vulnerable to privilege escalation in WebDAV

org.jenkins-ci.plugins:script-security

Jenkins Script Security Plugin allows for Bypass of Groovy Sandbox Protection

plone, plone

Chameleon in Plone allows Authentication Bypass

movim/moxl

XMPP Clients User Impersonation Vulnerability in Movim Moxl

salt

Salt uses weak permissions on the cache data

Umbraco.CMS

Umbraco CMS vulnerable to CSRF

Umbraco.CMS

Umbraco CMS vulnerable to CSRF

pysaml2

PySAML2 XML external entity attack

gethue

Cloudera HUE Account Enumeration

epiceditor

EpicEditor XSS Vulnerability

bcit-ci/codeigniter

CodeIgniter arbitrary code execution

weblate

Weblate user account enumeration via reset password form

org.apache.hadoop:hadoop-client

Client BlockTokens not checked in Apache Hadoop

org.apache.hadoop:hadoop-common, org.apache.hadoop:hadoop-common

Improper Authentication in Apache Hadoop

org.apache.hadoop:hadoop-main, org.apache.hadoop:hadoop-main

Apache Hadoop allows impersonation of arbitrary cluster user accounts

imdbphp/imdbphp

imdbphp Cross-Site Scripting (XSS)

org.apache.hadoop:hadoop-common, org.apache.hadoop:hadoop-common

Improper Authentication in Apache Hadoop

security-monkey

Netflix Security Monkey Open Redirect vulnerability

cherrymusic

Cherry Music directory traversal vulnerability

cherrymusic

Cherry Music Cross-site Scripting (XSS) vulnerability

glance

OpenStack Glance Server-Side Request Forgery (SSRF)

org.apache.ambari:ambari

Apache Ambari reveals administrator passwords

glance

OpenStack Glance Signature Verification Bypass

cryptography

Improper input validation in cryptography

org.apache.ambari:ambari

Apache Ambari Improper Access Control

dweeves/magmi

Magmi XSS Vulnerability

movingbytes/social-network

SocialNetwork Cross-Site Scripting (XSS) vulnerability

capstone

Capstone Integer overflow

genix/cms

GeniXCMS SQL injection vulnerability

org.apache.geode:geode-core

Apache Geode information disclosure vulnerability

org.opendaylight.openflowplugin:openflowplugin

OpenFlow plugin for OpenDaylight allows spoofing the SDN topology

org.opendaylight.openflowplugin:openflowplugin

OpenFlow plugin for OpenDaylight LLDP Relay

org.jboss.resteasy:resteasy-client

JacksonJsonpInterceptor susceptible to cross-site script inclusion (XSSI) attack

salt

SaltStack has insecure /tmp file handling in salt/modules/chef.py

salt

Salt improper handling of tmp files

nilsteampassnet/teampass

TeamPass vulnerable to SQL Injection

nilsteampassnet/teampass

TeamPass vulnerable to Cross-site Scripting

org.jboss.resteasy:resteasy-client, org.jboss.resteasy:resteasy-client

Improper Neutralization of Input During Web Page Generation in RESTEasy

craftcms/cms

Craft CMS XSS Vulnerability

pillow

Pillow Buffer overflow in Jpeg2KEncode.c

austintoddj/canvas

Canvs Canvas Cross-site Scripting (XSS) via title and content fields