Open Source Vulnerabilities

simplesamlphp/simplesamlphp

SimpleSAMLphp allows timing side-channel attacks

org.jboss.resteasy:resteasy-jaxrs

Denial of service in JBoss resteasy

katello

katello Cross-site Scripting vulnerability

github.com/hpcng/singularity

Singularity Incorrect Access Control

rubygems-update, org.jruby:jruby-stdlib

RubyGems Deserialization of Untrusted Data vulnerability

rubygems-update, org.jruby:jruby-stdlib

RubyGems Improper Verification of Cryptographic Signature vulnerability

rubygems-update, org.jruby:jruby-stdlib

RubyGems Cross-site Scripting vulnerability

rubygems-update, org.jruby:jruby-stdlib

RubyGems Improper Input Validation vulnerability

shopware/shopware

Shopware XXE Vulnerability

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Special Elements used in an LDAP Query in Jenkins

org.jvnet.hudson.plugins:favorite

Jenkins Favorite Plugin vulnerable to Cross-Site Request Forgery

org.apache.camel:camel-hessian, org.apache.camel:camel-hessian

Apache Camel camel-hessian component vulnerable to Java object deserialization

rsa

Python RSA allows attackers to spoof signatures

org.infinispan:infinispan-core

Deserialization of Untrusted Data in Infinispan

org.biouno:uno-choice

Cross-site Scripting in Jenkins Active Choices plugin

org.jenkins-ci.plugins:deploy

Jenkins Deploy to container Plugin stored plain text passwords in job configuration

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent, com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent, com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent

Cross-site Scripting in wicket-jquery-ui

com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent, com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent, com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent

Cross-site Scripting in wicket-jquery-ui

logstash

Elasticsearch Logstash allows remote attackers to execute arbitrary commands

logstash-core

Logstash Logs Sensitive Information

org.apache.uima:uimafit-core, org.apache.uima:uimaj-core, org.apache.uima:uimaj-core, org.apache.uima:uimaj-as-core

Improper Restriction of XML External Entity Reference in Apache uimaj

curl

curl FTP path confusion leads to NIL byte out of bounds write

org.igniterealtime.openfire:parent

Ignite Realtime Openfire vulnerable to cross-site scripting

web2py

web2py remote code execution via hardcoded encryption key in session.connect function

web2py

web2py exposure of sensitive information

web2py

web2py is vulnerable to password brute-force attack

jsmitty12/phpwhois, phpwhois/phpwhois, brightlocal/phpwhois, david-garcia/phpwhois, ivankristianto/phpwhois, kazist/phpwhois, serluck/phpwhois, simple-updates/phpwhois, truckersmp/phpwhois

phpWhois arbitrary code execution via a crafted whois record

org.apache.geode:geode-core

Apache Geode OQL method invocation vulnerability

bundler

Bundler allows attacker to inject arbitrary code via secondary Gem source

puppet

Puppet does not properly restrict access to node resources

puppet, puppet

Puppet uses predictable filenames, allowing arbitrary file overwrite

puppet, puppet

Puppet arbitrary file overwrite

puppet, puppet

Puppet allows local users to modify the permissions of arbitrary files

facter

Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata

puppetlabs-rabbitmq

puppetlabs-rabbitmq allows local users to obtain sensitive information

puppet, puppet

Puppet Denial of Service and Arbitrary File Write

puppet, puppet

Puppet Arbitrary Command Execution

puppet, puppet

Puppet uses predictable filenames, allowing arbitrary file overwrite

puppet, puppet

Puppet Privilege Escallation

laravel/framework, laravel/framework

Laravel Framework RCE Vulnerability

org.springframework:spring-core, org.springframework:spring-core

Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

dweeves/magmi

MAGMI plugin for Magento Unsafe File Upload

zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest, zendframework/zendservice-audioscrobbler, zendframework/zendservice-nirvanix, zendframework/zendservice-slideshare, zendframework/zendservice-technorati, zendframework/zendservice-windowsazure, zendframework/zendservice-amazon, zendframework/zendservice-api

Several Zend Products Vulnerable to XXE and XEE attacks

zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest, zendframework/zendservice-audioscrobbler, zendframework/zendservice-nirvanix, zendframework/zendservice-slideshare, zendframework/zendservice-technorati, zendframework/zendservice-windowsazure, zendframework/zendservice-amazon, zendframework/zendservice-api

Several Zend Products Vulnerable to XXE and XEE attacks

zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest, zendframework/zendservice-audioscrobbler, zendframework/zendservice-nirvanix, zendframework/zendservice-slideshare, zendframework/zendservice-technorati, zendframework/zendservice-windowsazure, zendframework/zendservice-amazon, zendframework/zendservice-api

Several Zend Products Vulnerable to XXE and XEE attacks

drupal/core, ckeditor-dev, drupal/core, drupal/drupal, drupal/drupal

Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

org.apache.ws.security:wss4j, org.apache.wss4j:wss4j-ws-security-dom

Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

org.simpleframework:simple-xml

SimpleXML has XML External Entity (XXE) vulnerability

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle SSRF Vulnerability