Open Source Vulnerabilities

zencart/zencart

Authenticated RCE in Zen Cart 1.5.5e

org.wildfly:wildfly-parent

The Undertow module of WildFly allows source code disclosure

drupal/drupal

Drupal Node Validation Bypass in the node module API

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle vulnerable to symlink attack

trac

Trac vulnerable to denial of service

typo3/cms-backend

TYPO3 Cross-site Scripting vulnerability in the file backend module

typo3/cms-felogin

typo3/cms-felogin Cross-site Scripting vulnerability

trac

Trac has vulnerability in HTML sanitizer filter

com.github.seasarorg.mayaa:mayaa

Mayaa Cross-site Scripting vulnerability

org.springframework:spring-core, org.springframework:spring-core, org.springframework:spring-core

Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework

org.apache.struts:struts2-core, org.apache.struts:struts2-core

Apache Struts improper action name cleanup

org.apache.struts:struts2-core, org.apache.struts:struts2-core

Apache Struts vulnerable to possible DoS attack when using URLValidator

org.apache.struts.xwork:xwork-core

Apache Struts Open Redirect

org.apache.struts:struts-parent

Apache Struts Access Control Redirect

com.liferay.portal:release.portal.bom

Liferay Portal Vulnerable to XSS via a Knowledge Base Article Title

com.liferay.portal:release.portal.bom, com.liferay:com.liferay.login.authentication.openid.connect.web, com.liferay:com.liferay.login.web

Liferay Portal XSS Vulnerability

com.liferay.portal:release.portal.bom, com.liferay:com.liferay.frontend.taglib

Liferay Portal XSS Vulnerability

org.apache.commons:commons-email

Improper Input Validation in Apache Commons Email

com.liferay.portal:release.portal.bom

Liferay Portal Vulnerable to XSS via Mishandled Title or Summary in the Web Content Display

com.liferay.portal:release.portal.bom

Liferay Portal Vulnerable to XSS via an Invalid portletId

com.liferay.portal:release.portal.bom

Liferay Portal Vulnerable to XSS via a Crafted Redirect Field

openpgp

OpenPGP 1.2.0 and earlier decrypts arbitrary messages

craftcms/cms

Craft CMS XSS Vulnerability

electron

Electron vulnerable to remote command execution

Microsoft.ChakraCore

ChakraCore information disclosure vulnerability

mantisbt/mantisbt

MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle SQL injection via user preferences

opensolutions/vimbadmin

ViMbAdmin CSRF Vulnerabilities

com.opensymphony:xwork, com.opensymphony:xwork

Improper Input Validation in OpenSymphony XWork

formencode

FormEncode Access Restrictions Bypass

moin, moin

MoinMoin Access Restrictions Bypassed due to improper ACL enforcement

cobbler

Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability

ocrodjvu

ocrodjvu is vulnerable to Arbitrary File Modification via symlink attack

ec-cube/ec-cube

EC-CUBE XSS Vulnerabilities

loggerhead

Loggerhead XSS via filename

plone

Plone Privilege Escalation Vulnerability

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin allows remote attackers to obtain installation path via direct request for nonexistent file

moin

MoinMoin Cross-site Scripting (XSS) vulnerability

org.apache.tomcat:tomcat

Apache Tomcat does not follow ServletSecurity annotations

qooxdoo

QooxDoo XSS in Callback Parameter

salt, salt

salt password information leaked in debug logs

restkit

Restkit Does Not Validate TLS certificates

com.google.gwt:gwt

Improper Neutralization of Input During Web Page Generation in Google Web Toolkit

org.springframework.batch:spring-batch-admin-manager

Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality

django-cms, django-cms

django-cms CSRF Vulnerability

org.springframework.batch:spring-batch-admin-manager

Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

nova

OpenStack Compute (Nova) Improper Access Control

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

attic

attic has improper verification of unencrypted backups

trove

Openstack DBaaS (Trove) Improper Link Resolution Before File Access