Open Source Vulnerabilities

silverstripe/cms, silverstripe/framework

Silverstripe CMS Open Redirect

typo3/cms, typo3/cms, typo3/cms

TYPO3 cross-site scripting (XSS)

org.elasticsearch:elasticsearch

Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

org.apache.james:james-server

Apache James Server OS Command Injection

symfony/symfony, symfony/symfony, symfony/symfony, symfony/security-http, symfony/security-http, symfony/security, symfony/security, symfony/security

Symfony Session Fixation Vulnerability

cakephp/cakephp

CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter

org.apache.openmeetings:openmeetings-install

Apache OpenMeetings Directory Traversal vulnerability

org.apache.sling:org.apache.sling.servlets.post

Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings Cross-site Scripting vulnerability

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings Cross-site Scripting vulnerability

shopware/shopware, shopware/shopware

Shopware RCE Vulnerability

org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui, org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui, org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui

WSO2 Carbon vulnerable to Cross-site Scripting

org.wso2.carbon.commons:org.wso2.carbon.logging.view.ui

WSO2 Carbon directory traversal vulnerability

org.apache.shiro:shiro-core

Improper Access Control in Apache Shiro

org.apache.qpid:qpid-jms-client

Improper Input Validation in Apache Qpid AMQP 0-x JMS

django, django, django

Django Cross-site scripting Vulnerability

org.apache.shiro:shiro-all, org.apache.shiro:shiro-web

Improper Access Control in Apache Shiro

plone, plone

Plone vulnerable to filesystem information leak

plone, plone

Plone XSS

plone, plone, plone

Plone Open Redirect Vulnerability

plone, plone, plone

Plone XSS

plone, plone, plone

Plone Cross-site Scripting (XSS) vulnerability

plone, plone

Plone vulnerable to Cross-site Scripting

org.apache.sling:org.apache.sling.servlets.post

Improper Neutralization of Input During Web Page Generation Apache Sling Servlets Post

org.jenkins-ci.plugins:resource-disposer

Jenkins Resource Disposer Plugin allows attacker to stop tracking specified resource

silverstripe/cms, silverstripe/framework

SilverStripe vulnerable to Cross-site Scripting

org.apache.activemq:activemq-web-console

Apache ActiveMQ Sensitive Information Disclosure via the Jetty ResourceHandler

org.apache.axis2.wso2:axis2

Improper Neutralization of Input During Web Page Generation in Apache Axis2

mantisbt/mantisbt

MantisBT Cross-site Scripting vulnerability

org.springframework.security:spring-security-core, org.springframework.security:spring-security-core, org.acegisecurity:acegi-security

Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

org.apache.shiro:shiro-root

Apache Shiro Path Traversal vulnerability

spree, spree

Spree allows remote attackers to obtain sensitive information

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Improper Neutralization of Input During Web Page Generation in Apache Tomcat

org.apache.tomcat:tomcat

Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header

org.apache.archiva:archiva

Apache Archiva does not require entry of the administrator's password at the time of modifying a user account

impresscms/impresscms

ImpressCMS Cross-site Scripting vulnerability via quicksearch_ContentContent parameter

symfony/form, symfony/form, symfony/form, symfony/form, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony

Symfony SSRF Vulnerability via Form Component

org.apache.geronimo.plugins:console

Apache Geronimo Application Server multiple directory traversal vulnerabilities

phpmailer/phpmailer

PHPMailer susceptible to arbitrary code execution

DotNetNuke.Core

DotNetNuke Default Machine Key Exposure

org.jboss.resteasy:resteasy-bom

JBoss RESTEasy vulnerable to Improper Input Validation

pimcore/pimcore

Pimcore SQLi Vulnerability

pimcore/pimcore

Pimcore CSRF Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability