Open Source Vulnerabilities

org.graylog2:graylog2-server

Cross-site Scripting in Graylog Server

pagekit/pagekit

Pagekit open redirect vulnerability

aubio

Aubio is vulnerable to denial of service via aubio_source_avcodec_readframe function

org.glassfish:mojarra-parent

Path Traversal in Eclipse Mojarra

gleez/cms

Gleez Cms Cross-site Scripting in Profile Page

paypal/permissions-sdk-php

paypal/permissions-sdk-php reflected Cross-site Scripting (XSS)

paypal/invoice-sdk-php

paypal/invoice-sdk-php reflected XSS

intelliants/subrion

Subrion CMS XSS

org.jenkins-ci.plugins:meliora-testlab

Jenkins meliora-testlab Plugin allows attackers with file system access to Jenkins master to obtain API key

org.jenkins-ci.plugins:shelve-project-plugin

Stored Cross-Site Scripting Vulnerability in Jenkins Shelve Project Plugin

mantisbt/mantisbt

MantisBT allows XSS on the Edit Filter page via crafted filter name

simplesamlphp/simplesamlphp

SimpleSAMLphp Information leakage issue in the sanitycheck module

com.tinfoilsecurity.plugins:tinfoil-scan

Exposure of sensitive information vulnerability

simplesamlphp/saml2, simplesamlphp/saml2, simplesamlphp/saml2

SimpleSAMLphp SAML2 library Regular Expression Denial of Service vulnerability

org.apache.ws.security:wss4j, org.apache.ws.security:wss4j, wss4j:wss4j

Improper Access Control in Apache WSS4J

apache-airflow

Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint

de.tracetronic.jenkins.plugins:ecutest

Jenkins TraceTronic ECU-TEST Plugin Man in the middle vulnerability

de.tracetronic.jenkins.plugins:ecutest

Jenkins TraceTronic ECU-TEST Plugin server-side request forgery vulnerability

drupal/core, drupal/drupal

Drupal PECL YAML parser unsafe object handling

mantisbt/mantisbt

MantisBT allows XSS via View Filters page

com.inedo.buildmaster:inedo-buildmaster

Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation

bacula-web/bacula-web

Bacula-web SQL Injection Vulnerabilities

com.inedo.proget:inedo-proget

Jenkins Inedo ProGet Plugin globally and unconditionally disabled SSL/TLS certificate validation

org.jenkins-ci.plugins:collabnet

Jenkins CollabNet Plugin man in the middle vulnerability

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Apache Tomcat does not enforce the maxHttpHeaderSize limit

org.apache.archiva:archiva, org.apache.continuum:continuum, org.apache.continuum:continuum

Apache Continuum and Archiva vulnerable to Cross-site Scripting

org.apache.tomcat:tomcat

Apache Tomcat allows remote attackers to bypass intended access restrictions

org.apache.tomcat:tomcat

Access controll bypass in Apache Tomcat

org.apache.tomcat:tomcat

Access restriction bypass in Apache Tomcat

org.apache.struts.xwork:xwork-core

XWork in Apache Struts Reveals Sensitive Information

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin remote variable manipulation

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin vulnerable to static code injection

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin Directory Traversal vulnerability

org.springframework:spring-core, org.springframework.security:spring-security-core, org.springframework.security:spring-security-core

Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data

plone, plone, plone

Plone Open Redirection vulnerability via next parameter

org.glassfish:javax.faces, org.glassfish:javax.faces

Improper Neutralization of Input During Web Page Generation in Mojarra

com.jamonapi:jamon

Improper Neutralization of Input During Web Page Generation in JAMon

apache-libcloud

Libcloud does not properly scrub data when destroying a DigitalOcean node

dompdf/dompdf

DOMPDF Arbitrary File Read

cobbler, cobbler

Cobbler Path Traversal vulnerability

org.apache.syncope:syncope

Apache Syncope uses a weak PNRG

org.elasticsearch:elasticsearch

Cross-site scripting in Elasticsearch

org.apache.struts:struts2-core

Cross-Site Request Forgery in Apache Struts

org.apache.cassandra:apache-cassandra, org.apache.cassandra:apache-cassandra

Improper Neutralization of Special Elements used in a Command in Apache Cassandra

org.elasticsearch:elasticsearch, org.elasticsearch:elasticsearch

Improper Access Control in Elasticsearch

fat_free_crm

Fat Free CRM Cross-Site Request Forgery vulnerability

org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-core

Improper Input Validation in Apache Jackrabbit

org.opencms:opencms-core

Alkacon OpenCMS XSS via homelink, workplaceresource, mode and query parameters

org.apache.storm:storm

Apache Storm remote code execution vulnerability

org.elasticsearch:elasticsearch

Improper Access Control in Elasticsearch