Open Source Vulnerabilities

dijit

dijit editor cross-site scripting vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Authentication in Jenkins

mautic/core

Mautic Cross Site Scripting (XSS) vulnerability

austintoddj/canvas

Canvs Canvas XSS Vulnerability

dolibarr/dolibarr

Dolibarr ERP and CRM contain XSS Vulnerability

croogo/croogo

Cross site scripting in Croogo

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA SessionID present in Audit Event Logs

simplesamlphp/saml2, simplesamlphp/saml2, simplesamlphp/saml2, simplesamlphp/saml2

SimpleSAMLphp SAML2 spoof SAML responses

org.jvnet.hudson.plugins:android-lint

XXE vulnerability in Jenkins Android Lint Plugin

org.jenkins-ci.plugins:junit

Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin

phpmyadmin/phpmyadmin

phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature

org.jenkins-ci.plugins.workflow:workflow-support

Arbitrary code execution due to incomplete sandbox protection in Pipeline: Supporting APIs Plugin

tikiwiki/tiki-manager

Tiki Wiki CMS XSS Vulnerability

mxgraph

mxGraph vulnerable to XXE attacks

org.jvnet.hudson.plugins:ccm

Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference

org.apache.oozie:oozie-core

Path Traversal in Apache Oozie

org.apache.james.hupa:hupa-parent

Apache James Hupa Webmail application Cross-site Scripting Vulnerabilities

org.apache.geode:geode-core

Apache Geode configuration request authorization vulnerability

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal cross site scripting vulnerability

drupal/core, drupal/drupal

Drupal external link injection vulnerability

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal cross-site scripting vulnerability

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal Comment reply form allows access to restricted content

org.apache.geode:geode-core

Apache Geode unsafe deserialization of application objects

uwsgi

uWSGI Directory Traversal vulnerability

org.apache.geode:geode-core

Apache Geode unsafe deserialization in TcpServer

org.apache.ode:ode

Apache ODE Path Traversal vulnerability

com.liferay.portal:release.portal.bom

Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page

simplesamlphp/saml2, simplesamlphp/saml2, simplesamlphp/saml2

SimpleSAMLphp saml2 incorrect signature validation

org.jenkins-ci.plugins:testlink

Stored cross-site scripting vulnerability in Jenkins TestLink Plugin

org.jenkins-ci.plugins:cppncss

Reflected cross-site-scripting vulnerability in report URL of Jenkins CppNCSS Plugin

django-anymail

django-anymail Includes Sensitive Information in Log Files

yiisoft/yii2-redis

yii2-redis Potential Remote code execution

getgrav/grav

Grav CMS Cross-site scripting (XSS) vulnerability

org.apache.openjpa:openjpa, org.apache.openjpa:openjpa

Deserialization of Untrusted Data in Apache OpenJPA

quickapps/cms

QuickAppsCMS Cross-Site Request Forgery (CSRF)

github.com/hashicorp/terraform-provider-aws

HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG

github.com/docker/notary

Docker Notary Signature Algorithm Not Matched to Key vulnerability

typo3/cms

Typo3 XSS Vulnerability

gleez/cms, gleez/cms

Gleez CMS Stored XSS

org.wildfly:wildfly-parent, org.wildfly:wildfly-undertow

WildFly has incomplete blacklist vulnerability

org.apache.hadoop:hadoop-common

Insecure Inherited Permissions in Apache Hadoop

ldap_fluff

ldap_fluff authentication bypass

org.jenkins-ci.plugins:cucumber-living-documentation

Jenkins Cucumber Living Documentation Plugin Cross-site Scripting vulnerability

org.jvnet.hudson.plugins:perforce

Jenkins Perforce Plugin exposure of sensitive information vulnerability exists

org.jenkins-ci.plugins:reverse-proxy-auth-plugin

Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users

org.jenkins-ci.plugins:vsphere-cloud

Jenkins vSphere Plugin disables SSL/TLS certificate validation by default

org.jenkins-ci.plugins:ghprb

Jenkins GitHub Pull Request Builder Plugin

org.jenkins-ci.plugins:ghprb

Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentials

org.jenkins-ci.plugins:vsphere-cloud

Jenkins vSphere Plugin Cross-Site Request Forgery vulnerability

org.jenkins-ci.plugins:copy-to-slave

Jenkins Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system