Open Source Vulnerabilities

roundup

Roundup Cross-site Scripting (XSS) vulnerability

roundup

Roundup Cross-site scripting (XSS) vulnerability

roundup

Roundup Cross-site Scripting (XSS) vulnerability

typo3/cms, typo3/cms, typo3/cms

Typo3 Backend History Module Vulnerable to XSS

typo3/cms, typo3/cms, typo3/cms

Typo3 Backend History Module Vulnerable to SQL Injection

typo3/cms, typo3/cms, typo3/cms

Typo3 Function Menu API XSS Vulnerability

typo3/cms, typo3/cms, typo3/cms

Typo3 Backend API XSS Vulnerability

symfony/symfony, symfony/yaml

Symphony Vulnerable to PHP Code Injection via YAML Parsing

symfony/symfony, symfony/symfony, symfony/symfony, symfony/yaml, symfony/yaml, symfony/yaml

Symfony Arbitrary PHP code Execution

nova

OpenStack Compute (Nova) Denial of service via a large number of calls to the addFixedIp function

glance

OpenStack Glance is vulnerable to Exposure of Sensitive Information

org.apache.activemq:activemq-client

Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ

karteek-docsplit

Karteek Docsplit vulnerable to OS Command Injection

keystone

OpenStack Identity (Keystone) improper revoking of the authentication token when deleting a user

portage

Gentoo Portage does not verify X.509 certificates from SSL servers

org.apache.sling:org.apache.sling.api

Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling

django

Django cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget

DotNetNuke.Core, DotNetNuke.Core

DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter

georgringer/news

News system (news) extension for TYPO3 vulnerable to SQL Injection

jambagecom/div2007

Static Methods since 2007 (div2007) extension for TYPO3 vulnerable to Cross-site Scripting

bednee/cooluri

CoolURI extension for TYPO3 vulnerable to SQL Injection

sjbr/static-info-tables

Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting

org.jenkins-ci.main:jenkins-core

Jenkins allows Cross-Site Scripting (XSS) in User Configuration

typo3/cms-core, typo3/cms-core, typo3/cms-core, typo3/cms-core

TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework

typo3/cms, typo3/cms, typo3/cms, typo3/cms

TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component

neos/flow, neos/flow, typo3/flow, typo3/flow

TYPO3 Flow Cross-site scripting (XSS) vulnerability

typo3/cms-core, typo3/cms-core

TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module

nova

OpenStack Nova Live migration can leak root disk into ephemeral storage

rply

RPLY Predictable Tmpfile Names Allows Cache Spoofing

pyxdg

pyxdg Arbitrary File Overwrite via Race Condition

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins directory traversal vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins cross-site scripting (XSS) vulnerability

org.apache.poi:poi

Improper Restriction of XML External Entity Reference in Apache POI

salt

SaltStack Salt Insecure Temporary File Creation

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Jenkins Path Traversal vulnerability

org.apache.poi:poi, org.apache.poi:poi

Improper Input Validation in Apache POI

salt, salt

SaltStack Salt Directory traversal vulnerability in minion id validation

zendframework/zend-diactoros

zend-diactoros Cross-site Scripting (XSS)

org.apache.atlas:atlas-common

Insecure cookie storage in Apache Atlas

org.apache.atlas:atlas-common

Path Traversal in Apache Atlas

org.apache.atlas:atlas-common

Cross-site Scripting in Apache Atlas

org.apache.atlas:atlas-common

Cross-site Scripting in Apache Atlas

simplesamlphp/simplesamlphp

SimpleSAMLphp Incorrect IV generation for encryption

simplesamlphp/simplesamlphp

SimpleSAMLphp Unauthenticated encryption in CBC mode

org.apache.atlas:atlas-common

Apache Atlas produces Stack trace in error response

org.apache.atlas:atlas-common

Cross-site Scripting in Apache Atlas

scrapy

Scrapy denial of service vulnerability

swift

OpenStack Swift metadata constraints are not correctly enforced

co-stack/fal_sftp, vertexvaar/falsftp

fal_sftp extension for TYPO3 uses weak permissions for sFTP driver files and folders

smarty/smarty

Smarty arbitrary PHP code execution