Open Source Vulnerabilities

django, django

Django User Enumeration Vulnerability

django, django

Django XSS Vulnerability

org.apache.hadoop:hadoop-yarn-server-nodemanager, org.apache.hadoop:hadoop-yarn-server-nodemanager

Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

designate

Designate mDNS DoS through incorrect handling of large RecordSets

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

dolibarr/dolibarr

Dolibarr SQL injection vulnerability in don/list.php

dolibarr/dolibarr

Dolibarr SQL injection vulnerability in admin/menus/edit.php

dolibarr/dolibarr

Dolibarr ERP and CRM Sensitive Data Disclosure

org.apache.tomcat:tomcat

Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Authentication Bypass in Apache Tomcat

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Cross-Site Request Forgery in Apache Tomcat

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Improper Access Control in Apache Tomcat

python-keystoneclient

python-keystoneclient unsecure user password update

genix/cms

GeniXCMS denial of service (account blockage)

dolibarr/dolibarr

Dolibarr cross-site scripting (XSS) vulnerability

org.apache.directory.api:api-ldap-model

Exposure of Sensitive Information to an Unauthorized Actor in Apache Directory LDAP API

moodle/moodle, moodle/moodle, moodle/moodle

Moodle XSS Vulnerability

org.apache.brooklyn:brooklyn-rest-resources, org.apache.brooklyn:brooklyn-jsgui

Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)

org.jenkins-ci.main:jenkins-core

Jenkins HttpOnly flag not Set for session cookies

org.jenkins-ci.main:jenkins-core

Jenkins secure flag not set on session cookies

org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core

Incomplete exclude pattern in Apache Struts

django

Django ReDoS in validators.URLValidator

django, django, django

Django Vulnerable to HTTP Response Splitting Attack

fastly/magento2

Fastly Magento2 sensitive information disclosure

phpbb/phpbb, phpbb/phpbb

phpBB Open Redirect

org.apache.brooklyn:brooklyn

Cross-site Scripting In Apache Brooklyn

nodebb, nodebb-plugin-markdown

NodeBB Cross-site Scripting Vulnerability in Markdown Processing

moodle/moodle, moodle/moodle, moodle/moodle

Moodle sensitive information disclosure

codeigniter/framework, kohana/core

CodeIgniter and Kohana vulnerable to PHP Object Injection

org.apache.brooklyn:brooklyn

Deserialization of Untrusted Data in Apache Brooklyn

genix/cms

GeniXCMS Cross-site Scripting (XSS) via id parameter

genix/cms

GeniXCMS Cross-site Scripting (XSS) vulnerability via id parameter

genix/cms

GeniXCMS Cross-site Scripting (XSS) via the Menu ID field

genix/cms

GeniXCMS arbitrary PHP code execution

ipython

Improper Neutralization of Input During Web Page Generation in IPython

django, django, django

Django denial of service via empty session record creation

plone, plone, plone, plone, plone, plone

Plone Cross-site Scripting Vulnerability

products-cmfplone, products-cmfplone, plone, plone, plone, plone, plone, plone

Plone unauthorized member addition vulnerability

plone

Plone Header Injection

ipython, ipython

IPython vulnerable to cross site request forgery (CSRF)

egroupware/egroupware

eGroupware Community Edition Stored XSS vulnerability

plone

Plone vulnerable to cross-site request forgery

salt, salt, salt

SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

org.apache.geode:geode-core

Apache Geode gfsh query vulnerability

laravel/framework, illuminate/auth

Laravel Sensitive Data Exposure

commons-jelly:commons-jelly

Improper Restriction of XML External Entity Reference in Jelly

org.apache.wicket:wicket-core, org.apache.wicket:wicket-core

Apache Wicket allows attackers to check for third-party libraries

org.jenkins-ci.plugins:docker-commons

Jenkins Docker Commons Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

org.jenkins-ci.plugins:pollscm

Jenkins Poll SCM Plugin vulnerable to Cross-Site Request Forgery

org.jenkins-ci.plugins:git

Cross-Site Request Forgery in Jenkins Git Plugin