Open Source Vulnerabilities

org.jenkins-ci.plugins:accurev

Jenkins Accurev Plugin CSRF vulnerability and missing permission checks

org.jenkins-ci.plugins:maven-artifact-choicelistprovider

Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks

org.csanchez.jenkins.plugins:kubernetes

Exposure of Sensitive Information in Jenkins Kubernetes Plugin

org.jenkins-ci.plugins:pangolin-testrail-connector

Jenkins Agiletestware Pangolin Connector for TestRail Plugin CSRF vulnerability and missing permission checks

org.jenkins-ci.plugins:ssh-agent

Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log

athlon1600/php-proxy

Weak Cryptography in PHP-Proxy

showdoc/showdoc

Showdoc Unauthenticated Access

phpbb/phpbb

phpBB Remote Code Execution

pg-query, pglast

libpg_query memory leak

asciidoctor

Asciidoctor Infinite Loop vulnerability

TGServiceInterface

Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server

ansible, ansible, ansible

Ansible Leaks Data Passed to ssh-keygen

matrix-synapse, matrix-synapse

Matrix Synapse Improper Signature Validation

openssl, openssl

Ruby Openssl Allows Incorrect Value Comparison

aubio

Aubio is vulnerable to out of bound read when samplerate > 50kHz

oxid-esales/paymorrow-module, oxid-esales/paymorrow-module

Paymorrow Improper Input Validation vulnerability

org.apache.guacamole:guacamole-common

Missing Encryption of Sensitive Data in Apache Guacamole

cloudtoken

Cloudtoken Insufficiently Protects Credentials

org.apache.jmeter:ApacheJMeter

Missing certificate validation in Apache JMeter

net.opentsdb:opentsdb

OpenTSDB vulnerable to OS Command Injection

org.apache.jmeter:ApacheJMeter

Missing certificate validation in Apache JMeter

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings may allow authenticated attacker to deny service for privileged users

passenger

Phusion Passenger incorrect permission assignment

froxlor/froxlor

Froxlor Incorrect Access Control

express-cart

express-cart allows any user to create an admin user

matrix-synapse

Matrix Synapse Authorization Error

matrix-synapse

Matrix Synapse Security Filtering Flaw

passenger

Incorrect Access Control in Phusion Passenger

passenger

Insecure Permissions in Phusion Passenger

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Cross-site Scripting

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Improper Privilege Management

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA accepts refresh token as access token on admin endpoints

pulpcore

Withdrawn Advisory: Pulp Improper Path Parsing

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames

osxcollector

Yelp OSXCollector Improper Certificate Validation

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Loop with Unreachable Exit Condition in Jenkins

org.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins:script-security

Jenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass

org.jenkins-ci.plugins:script-security

Improper Privilege Management in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Limitation of a Pathname to a Restricted Directory in Jenkins

io.jenkins:configuration-as-code

Jenkins Configuration as Code Plugin has Insufficiently Protected Credentials

org.grails.plugins:asset-pipeline, org.grails.plugins:asset-pipeline, org.grails.plugins:asset-pipeline

Asset Pipeline Grails Plugin vulnerable to Path Traversal

org.jenkins-ci.plugins:zos-connector

Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password

com.coravy.hudson.plugins.github:github

CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials

org.jenkins-ci.plugins:openstack-cloud

CSRF vulnerability and missing permission checks in Openstack Cloud Plugin allowed capturing credentials

org.jenkins-ci.plugins:mesos

Improper authorization vulnerability in Jenkins Mesos Plugin

com.amazonaws:aws-codepipeline

Jenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials

com.amazonaws:codedeploy

AWS CodeDeploy Plugin stored AWS Secret Key in plain text

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Authorization in Jenkins

com.amazonaws:aws-codebuild

Insufficiently Protected Credentials in Jenkins AWS CodeBuild Plugin

cobbler

Cobbler Improper Validation of Security Tokens