Open Source Vulnerabilities

org.jenkins-ci.plugins:distfork

Missing permission checks in Jenkins Distributed Fork Plugin

hammer_cli_foreman

hammer_cli_foreman Improper Certificate Validation vulnerability

org.jenkins-ci.plugins:mailer

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin

org.jenkins-ci.plugins:email-ext

Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin

katello

katello Improper Privilege Management vulnerability

cprice404:pipeline-classpath

Jenkins Pipeline Classpath Step plugin allowed Script Security sandbox bypass

org.springframework.flex:spring-flex

Deserialization of Untrusted Data in Spring-flex

com.exadel.flamingo.flex:amf-serializer

Deserialization of Untrusted Data in Flamingo amf-serializer

drupal/core, drupal/core, drupal/drupal, drupal/drupal

Drupal core access bypass vulnerability

drupal/core, drupal/drupal

Drupal file REST resource does not properly validate

drupal/core, drupal/drupal

Drupal REST API can bypass comment approval

org.jbpm.jbpm5:jbpmmigration

XML External Entity Reference in jbpmmigration

io.hawt:project

Cross-Site Request Forgery in hawtio

io.undertow:undertow-core, io.undertow:undertow-core, io.undertow:undertow-core

Undertow vulnerable to Request Smuggling

org.elasticsearch.plugin:x-pack

Improper Privilege Management in X-Pack

net.lingala.zip4j:zip4j

Improper Limitation of a Pathname to a Restricted Directory in Zip4j

k8s.io/kubernetes

Kubernetes arbitrary file overwrite

k8s.io/minikube

Minikube RCE via DNS Rebinding

org.codehaus.plexus:plexus-archiver

Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver

SharpZipLib

Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib

github.com/containers/podman

Podman Elevated Container Privileges

org.keycloak:keycloak-saml-adapter-core, org.keycloak:keycloak-services

Keycloak Authentication Error

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Exposure of Sensitive Information to an Unauthorized Actor

moodle/moodle, moodle/moodle, moodle/moodle

Moodle sensitive information disclosure

katello

katello SQL Injection vulnerability

neutron, neutron, neutron

Openstack Neutron vulnerable to eavesdropping on private traffic

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle XML import of ddwtos could lead to intentional remote code execution

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Cross-site Scripting

github.com/evanphx/json-patch, github.com/evanphx/json-patch

JSON-Patch Out-of-bounds Write vulnerability

org.keycloak:keycloak-core

Keycloak Open Redirect

org.keycloak:keycloak-parent, org.keycloak:keycloak-parent, org.keycloak:keycloak-parent

Keycloak vulnerable to cross-site scripting via the state parameter

org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA Privilege Escalation

mistral

openstack-mistral Discloses the presence of arbitrary files within the filesystem

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Login CSRF vulnerability in login form

org.elasticsearch:elasticsearch

Improper Restriction of XML External Entity Reference in Elasticsearch

org.elasticsearch:elasticsearch

Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

org.jboss.resteasy:resteasy-yaml-provider, org.jboss.resteasy:resteasy-yaml-provider

Deserialization of Untrusted Data in org.jboss.resteasy:resteasy-yaml-provider

moodle/moodle, moodle/moodle

Moodle Improper Authentication

io.undertow:undertow-core, io.undertow:undertow-core

Uncontrolled Resource Consumption in Undertow

org.infinispan:infinispan-core, org.infinispan:infinispan-core, org.infinispan:infinispan-core, org.infinispan:infinispan-core, org.infinispan:infinispan-core

Deserialization of Untrusted Data in Infinispan

org.springframework.batch:spring-batch-admin-manager

Cross-site Scripting in Pivotal Spring Batch Admin

express-cart

express-cart unrestricted file upload vulnerability

statics-server

statics-server Cross-site Scripting vulnerability

org.elasticsearch:elasticsearch, org.elasticsearch:elasticsearch

Elasticsearch subject to cross site scripting

nuclide

Nuclide Improper Input Validation

org.jenkins-ci.plugins:active-directory

Jenkins Active Directory Plugin Improper certificate validation with StartTLS

io.jenkins.blueocean:blueocean

Cross-site Scripting in Jenkins Blue Ocean Plugin

org.jenkins-ci.plugins:github-oauth

GitHub Authentication Plugin showed plain text client secret in configuration form

org.jenkins-ci.plugins:job-import-plugin

XXE vulnerability in Jenkins Job Import Plugin

org.jvnet.hudson.plugins:warnings

Sandbox Bypass via CSRF in Jenkins Warnings Plugin