Open Source Vulnerabilities

org.jenkins-ci.plugins:github-branch-source

Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery

org.datadog.jenkins.plugins:datadog

Exposure of Sensitive Information in Jenkins Datadog plugin

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

org.jenkins-ci.plugins:dependency-check-jenkins-plugin

Persistent XSS vulnerability in Jenkins OWASP Dependency-Check Plugin

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

org.apache.wicket:wicket-core, org.apache.wicket:wicket-core, org.apache.wicket:wicket-core

Apache Wicket vulnerable to CSRF attacks

UmbracoCMS.Web

Umbraco CMS vulnerable to stored XSS

UmbracoCms.Web

Umbraco CMS XXE Vulnerability

nilsteampassnet/teampass

TeamPass Cross-Site Scripting (XSS)

org.apache.derby:derby

Improper Access Control in Apache Derby

org.apache.struts.xwork:xwork-core

Apache Struts CSRF Vulnerability

ccsv

ccsv Double Free vulnerability

org.jenkins-ci.plugins:role-strategy

CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration

org.jvnet.hudson.plugins:dry

Persistent XSS vulnerability in Jenkins DRY Plugin

org.jvnet.hudson.plugins:analysis-core

Persistent XSS vulnerability in Static Analysis Utilities

org.jenkins-ci.plugins:pipeline-input-step

Jenkins Pipeline: Input Step Plugin

org.apache.myfaces.core:myfaces-core-module, org.apache.myfaces.core:myfaces-core-module

Apache MyFaces Vulnerable to EL Injection

org.jenkins-ci.plugins:sidebar-link

Persisted XSS Vulnerability in Jenkins Sidebar Link Plugin

org.jenkins-ci.plugins:github-branch-source

Jenkins GitHub Branch Source Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

org.apache.opennlp:opennlp-tools

Improper Restriction of XML External Entity Reference in Apache OpenNLP

org.jenkins-ci.plugins:subversion

Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability

silverstripe/cms

Silverstripe CMS XSS Vulnerability

io.really:jwt-scala

Insufficient Data Verification in io.really:jwt-scala

silverstripe/cms, silverstripe/cms

Silverstripe CMS User Enumeration

zendframework/zendframework, zendframework/zendframework, zendframework/zendframework, zendframework/zendframework, zendframework/zendframework1

Zend Access Restriction Bypass

org.apache.xmlgraphics:batik

Improper Input Validation in Apache Batik

swiftmailer/swiftmailer

Swift Mailer mail transport Command Injection

django, django, django

Django DNS Rebinding Vulnerability

django, django, django

Django user with hardcoded password created when running tests on Oracle

org.apache.nifi:nifi

XML External Entity Reference in Apache NiFi

zendframework/zendframework, zendframework/zend-crypt, zendframework/zend-crypt, zendframework/zendframework

Zend Framework Information Disclosure

salt

salt leaks git usernames and passwords to the log

org.keycloak:keycloak-services

JBoss Keycloak CSRF Vulnerability

org.apache.nifi:nifi, org.apache.nifi:nifi

Injection in Apache NiFi

typo3/cms-backend, typo3/cms-backend, typo3/cms-backend, typo3/cms-backend

TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms

mistune

Cross-site Scripting in Mistune

org.apache.james:james-project

Apache James Privilege Escalation

mysql:mysql-connector-java

Improper Access Control in MySQL Connectors Java

salt, salt, salt

SaltStack Salt Directory traversal vulnerability in minion id validation

org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core

Denial of service in Apache Tomcat

org.apache.storm:storm

Apache Storm log viewer path traversal vulnerability

salt, salt, salt

SaltStack Salt Denial of Service via a crafted authentication request

org.igniterealtime.openfire:parent

Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console

django, django

Django cross-site scripting (XSS) vulnerability via is_safe_url function