Open Source Vulnerabilities

typo3/cms

TYPO3 Information Disclosure Vulnerability

drupal/core, drupal/drupal

Drupal editor module incorrectly checks access to inline private files

nova-lxd

OpenStack Nova-LXD bypass security restrictions

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Improper Handling of Exceptional Conditions in Apache Tomcat

org.apache.tomcat:tomcat, org.apache.tomcat:tomcat

Improper Resource Shutdown or Release in Apache Tomcat

org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-core

Expected Behavior Violation in Apache Tomcat

org.apache.nifi:nifi, org.apache.nifi:nifi

Improper Authentication In Apache NiFi

salt, salt, salt

SaltStack Salt arbitrary command execution in Salt-api via ssh_client

org.springframework.webflow:spring-webflow

Insecure Default Initialization of Resource in Pivotal Spring Web Flow

mysql-connector-python

MySQL Connectors Privilege Escalation

mysql:mysql-connector-java

Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java

mysql:mysql-connector-java

Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java

mysql:mysql-connector-java

Improper Access Control in MySQL Connectors Java

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin Improper Privilege Management

nova, nova

OpenStack Nova Denial of service attack on the compute host

nova

OpenStack Nova DoS by rebuilding the same instance with a new image multiple times

librenms/librenms

LibreNMS Arbitrary File Read

symfony/security-csrf, symfony/security-csrf, symfony/security-csrf, symfony/security-csrf, symfony/security, symfony/security, symfony/security, symfony/security, symfony/symfony, symfony/symfony, symfony/symfony, symfony/symfony

Symfony CSRF Vulnerability

pyanyapi

Unsafe pyyaml load usage in PyAnyAPI

nova, nova, nova

OpenStack Nova Filter Scheduler Bypass

dulwich

Dulwich RCE Vulnerability

borgbackup

Borg Improper Access Control vulnerability

nilsteampassnet/teampass

TeamPass Improper Privilege Management

nilsteampassnet/teampass

TeamPass Improper Privilege Management

nilsteampassnet/teampass

TeamPass Improper Privilege Management

genix/cms

GeniXCMS arbitrary PHP code execution

bzr

Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname

org.onosproject:onos-base

ONOS vulnerable to denial of service due to unrestricted NettyMessagingManager payload

com.nimbusds:nimbus-jose-jwt

Nimbus JOSE+JWT vulnerable to padding oracle attack

simplesamlphp/simplesamlphp

SimpleSAMLphp Invalid token creation and validation

numpy

Numpy missing input validation

aodh

Openstack Aodh can be used to launder Keystone trusts

tripleo-heat-templates

Openstack tripleo-heat-templates unauthenticated file access

Microsoft.AspNetCore.Server.WebListener, Microsoft.AspNetCore.Server.WebListener, Microsoft.Net.Http.Server, Microsoft.Net.Http.Server, Microsoft.AspNetCore.Server.HttpSys

Denial of service in ASP.NET Core

Microsoft.ChakraCore

ChakraCore vulnerable to privilege escalation

supervisor, supervisor, supervisor, supervisor

Incorrect Default Permissions in Supervisor

pyjwt

PyJWT vulnerable to key confusion attacks

codiad/codiad

Codiad Vulnerable to Shell Command Injection

contao/contao, contao/core-bundle, contao/core

Contao Core directory traversal vulnerability

baserproject/basercms, baserproject/basercms

Arbitrary file delete in baserCMS

puppet, puppet

Tarball permission preservation in puppet

electron

Electron vulnerable to URL spoofing via PDFium

plone, plone

Plone Unauthorized Access Vulnerability

org.jvnet.hudson.plugins:speaks

Arbitrary code execution vulnerability in Jenkins Speaks! Plugin

org.jenkins-ci.plugins:build-publisher

Jenkins Build-Publisher plugin has Insufficiently Protected Credentials

fs-git

fs-git command injection vulnerability

org.opendaylight.controller:releasepom

OpenDaylight Controller DoS

org.opendaylight.controller:releasepom

OpenDaylight NULL Pointer Dereference

alchemist.vim

alchemist.vim vulnerable to remote code execution

org.jvnet.hudson.plugins:ssh, org.jenkins-ci.plugins:ssh

Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext