Open Source Vulnerabilities

shopware/shopware

Shopware SQL Injection

org.jenkins-ci.plugins:config-file-provider

CSRF vulnerability in Config File Provider Plugin

org.jenkins-ci.plugins:email-ext

CSRF vulnerability in Email Extension Template Plugin

forkcms/forkcms

Fork CMS XSS Vulnerability

github.com/sylabs/singularity

Sylabs Singularity Improper Input Validation

phpmyadmin/phpmyadmin

phpMyAdmin SQL injection in Designer feature

org.jenkins-ci.plugins:junit

Jenkins JUnit Plugin CSRF vulnerability

org.apache.mesos:mesos

Crash when decoding malformed HTTP requests or malformed JSON payload

croogo/croogo

Croogo vulnerable to XSS in title field

croogo/croogo

Croogo vulnerable to XSS in title field

croogo/croogo

Croogo vulnerable to Cross-site Scripting in title field

croogo/croogo

Croogo vulnerable to XSS in title field

croogo/croogo

Croogo vulnerable to XSS in Blog field

org.jenkins-ci.plugins:mesos

Server-side request forgery vulnerability in Jenkins Mesos Plugin

com.sonyericsson.hudson.plugins.rebuild:rebuild

Cross-site Scripting in Jenkins Rebuilder Plugin

org.jenkins-ci.plugins:crowd2

Jenkins Crowd 2 Integration Plugin server-side request forgery vulnerability

github.com/caddyserver/caddy

Caddy allows enumeration of Certificates and Hostnames

gogs.io/gogs

Gogs Directory Traversal

trytond, trytond, trytond, trytond

trytond arbitrary fields write via a sequence of records

prestashop/prestashop

PrestaShop PHP Object Injection

org.owasp.esapi:esapi

Missing Cryptographic Step in OWASP Enterprise Security API for Java

glance

OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme

onionshare-cli

Withdrawn Advisory: OnionShare Predictable Pathname

github.com/hashicorp/consul

HashiCorp Consul can use cleartext agent-to-agent RPC communication

ec-cube/ec-cube

EC-CUBE Open redirect vulnerability

modx/revolution

MODX Revolution allows XSS via document resources

modx/revolution

MODX Revolution allows XSS through extended user fields

modx/revolution

MODX Revolution vulnerable to XSS attack through its User Photo field

buildbot

Buildbot CRLF Injection

pyboolector

Boolector use after free

helm.sh/helm

Helm Path Traversal

mpdf/mpdf

mPDF Unsafe Deserialization

fileutils

Fileutils Command Injection vulnerability

github.com/ory/hydra

Hydra has Reflected XSS via error_hint parameter

yiisoft/yii2

Yii Incorrectly Implements CORS

net.sourceforge.pmd:pmd-core

Improper Restriction of XML External Entity Reference in PMD

github.com/gofiber/fiber/v2, github.com/rs/cors

github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error

getkirby/kirby

Kirby XSS Vulnerability

intelliants/subrion

Subrion CMS XSS

laravel/framework

Laravel Framework Deserialization Vulnerability

evolutioncms/evolution

Evolution CMS Stored Cross-site Scripting (XSS)

evolutioncms/evolution

Evolution CMS Cross-site Scripting (XSS)

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry vulnerable to Improper Certificate Validation

org.apache.tomee:tomee-webapp

Apache TomEE console vulnerable to Cross-site Scripting

drupal/core, drupal/core, drupal/core, drupal/core, drupal/drupal, drupal/drupal, drupal/drupal, drupal/drupal

Drupal Core Remote Code Execution Vulnerability

org.apache.portals.pluto:pluto-container

Exposure of Sensitive Information in Apache Pluto

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings RCE

org.jenkins-ci.plugins:mailer

Cross-Site Request Forgery in Jenkins Mailer Plugin

asyncssh

AsyncSSH SSH Server Authentication Bypass

org.apache.commons:commons-email

Improper Input Validation Apache Commons Email