Open Source Vulnerabilities

modx/revolution

MODX Revolution Incorrect Access Control vulnerability

org.jenkins-ci.plugins:absint-astree

CSRF vulnerability and missing permission checks in Jenkins AbsInt Astrée Plugin

com.blackducksoftware.integration:blackduck-hub

Jenkins Black Duck Hub Plugin allowed any user with Overall/Read to read and write its configuration

org.jenkins-ci.plugins:liquibase-runner

Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM

org.jenkins-ci.plugins:vsphere-cloud

Jenkins vSphere Plugin incorrect authorization vulnerability

org.jvnet.hudson.plugins:perforce

Jenkins Perforce Plugin uses ineffective credentials encryption

lightsaml/lightsaml

LightSAML Incorrect Access Control vulnerability

org.jenkins-ci.plugins:promoted-builds

Jenkins Promoted Builds Plugin allowed unauthorized users to run some promotion processes

org.jenkins-ci.plugins:mercurial

Incorrect Authorization in Jenkins Mercurial Plugin

com.unboundid:unboundid-ldapsdk

Weak Password Requirements in UnboundID LDAP SDK

org.jenkins-ci.plugins:subversion

Jenkins Subversion Plugin Incorrect Authorization vulnerability

org.jenkins-ci.plugins:git

Incorrect Authorization in Jenkins Git Plugin

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger

Incorrect Authorization in Jenkins Gerrit Trigger Plugin

com.synopsys.jenkinsci:ownership

Improper authorization in Jenkins Job and Node Ownership Plugin

rubygems-update, org.jruby:jruby-stdlib

RubyGems Infinite Loop vulnerability

org.jenkins-ci.plugins:coverity

Jenkins Coverity Plugin has Insufficiently Protected Credentials

org.jenkins-ci.plugins:google-play-android-publisher

Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger

Incorrect Authorization in Jenkins Gerrit Trigger Plugin

org.jenkins-ci.plugins:credentials-binding

Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials

kreait/firebase-php

Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

baserproject/basercms, baserproject/basercms

baserCMS vulnerable to Access Control Bypass

baserproject/basercms, baserproject/basercms

baserCMS Access Control Bypass

org.apache.geode:geode-core

Apache Geode vulnerable to Exposure of Sensitive Information

org.apache.mesos:mesos, org.apache.mesos:mesos, org.apache.mesos:mesos

Use after free in Apache Mesos

github.com/juju/juju

Juju uses a UNIX domain socket without setting appropriate permissions

dolibarr/dolibarr

Dolibarr allows password changes without supplying the current password

Microsoft.AspNetCore.Mvc.Core, Microsoft.AspNetCore.Mvc.Core, Microsoft.AspNetCore.Mvc.Cors, Microsoft.AspNetCore.Mvc.Cors

Cross-origin Resource Sharing bypass in ASP.NET Core

genix/cms

GeniXCMS Mailbox validation logic vulnerability

craftcms/cms

Craft CMS Unauthorized View

org.springframework.webflow:spring-webflow

Insecure Default Initialization of Resource in Pivotal Spring Web Flow

salt

SaltStack Salt allows compromised salt-minions to impersonate the salt-master

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings vulnerable to Uncontrolled Resource Consumption

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings updates user password in insecure manner

org.apache.mesos:mesos, org.apache.mesos:mesos, org.apache.mesos:mesos

Denial of service in Apache Mesos

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings responds to insecure HTTP methods

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings vulnerable to parameter manipulation attacks

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings has Inadequate Encryption Strength

org.apache.openmeetings:openmeetings-parent

Apache OpenMeetings allows flash content to be loaded from untrusted domains

org.jboss.resteasy:resteasy-jaxrs, org.jboss.resteasy:resteasy-jaxrs

Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Unauthorized searching of arbitrary blogs by typing full url

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Improper Privilege Management

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle External blog editing takeover

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal access control bypass vulnerability

drupal/core, drupal/drupal

Drupal Settings Tray access bypass

buddypress/buddypress

BuddyPress Docs plugin Improper Privilege Management

drupal/core, drupal/drupal

Drupal access bypass vulnerability

drupal/core, drupal/drupal

Drupal access bypass vulnerability

drupal/core, drupal/drupal

Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions

drupal/core, drupal/drupal

Drupal Remote code execution