Open Source Vulnerabilities

pidusage

PIDUsage Enables OS Command Injection

org.opencastproject:opencast-kernel

Opencast has Incorrect Permission Assignment

org.jenkins-ci.plugins:script-security

Sandbox bypass in Jenkins Script Security Plugin sandbox bypass

io.jenkins.blueocean:blueocean

Improper Authentication in Jenkins Blue Ocean Plugin

mercurial

Mercurial is vulnerable to shell injection attack

org.jenkins-ci.plugins:config-file-provider

Improper Privilege Management in Jenkins Config File Provider Plugin

org.jenkins-ci.plugins:parameterized-trigger

Parameterized Trigger Plugin fails to check Item/Build permission

io.jenkins.blueocean:blueocean

Improper Authentication in Jenkins Blue Ocean Plugin

org.jenkins-ci.plugins.workflow:workflow-cps

Arbitrary code execution due to incomplete sandbox protection in Jenkins Pipeline

mautic/core

Sensitive Cookie Without HttpOnly and Secure Flag

org.jenkins-ci.plugins:pipeline-build-step

Jenkins Build Step Plugin fails to check Item/Build permission

org.jenkins-ci.plugins:script-security

Unsafe methods in the default list of approved signatures in Jenkins Script Security Plugin

trytond, trytond, trytond, trytond, trytond, trytond, trytond

Tryton Information Disclosure Vulnerability

anchorcms/anchor-cms

Anchor CMS Logs Credentials

yab/quarx

Yab Quarx persistent cross-site scripting vulnerability

org.jboss.ws:jbossws-common

JBossWS vulnerable to uncontrolled recursion

org.infinispan:infinispan-core

Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

logstash-core

Logstash Logs Sensitive Information

cobbler

Cobbler Arbitrary File Read

org.wildfly:wildfly-undertow

Red Hat Wildfly DoS

rubygems-update

RubyGems vulnerable to Deserialization of Untrusted Data

rubygems-update

RubyGems may allow a maliciously crafted gem to overwrite files

rubygems-update

RubyGems has Origin Validation Error vulnerability

rubygems-update

RubyGems Code Injection vulnerability

koji

Koji blacklisted paths workaround

bodhi

Bodhi Cross-site Scripting Vulnerability

k8s.io/kubernetes, k8s.io/kubernetes, k8s.io/kubernetes

Kubernetes arbitrary file overwrite

org.keycloak:keycloak-parent

Keycloak Reflected XSS

org.keycloak:keycloak-parent

Keycloak CSRF Vulnerability

io.undertow:undertow-core, io.undertow:undertow-core, io.undertow:undertow-core

Undertow Request Smuggling vulnerability

org.kohsuke:libpam4j

Improper Input Validation in libpam4j

io.undertow:undertow-core, io.undertow:undertow-core

Incorrect Authorization in Undertow

org.ovirt.engine.sdk:ovirt-engine-sdk-java

ovirt-engine Logs Plaintext Passwords To File

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Incomplete List of Disallowed Inputs in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Inadequate Encryption Strength in Jenkins

io.hawt:project

Path Traversal in io.hawt:project

io.hawt:project

Insecure cookie sharing in Hawtio

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Input During Web Page Generation in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Deserialization of Untrusted Data in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Input During Web Page Generation in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Authentication in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Cross-Site Request Forgery in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Incorrect Permission Assignment for Critical Resource in Jenkins

org.infinispan:infinispan-server-core

Infinispan Rest API Does Not Enforce Auth Constraints

org.jenkins-ci.plugins:active-directory

Jenkins Active Directory Plugin did not verify certificate of AD server

org.jenkins-ci.plugins:ssh-slaves

Jenkins SSH Build Agents Plugin did not verify host keys