Open Source Vulnerabilities

org.jenkins-ci.plugins:repository-connector

Jenkins Repository Connector Plugin has insufficiently protected credentials

org.jenkins-ci.plugins:matrix-project

Script security sandbox bypass in Matrix Project Plugin

org.jenkins-ci.plugins:azure-vm-agents

Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin

org.jenkins-ci.plugins:youtrack-plugin

Jenkins youtrack-plugin Plugin stored credentials in plain text

de.e-nexus:jabber-server-plugin

Jenkins Jabber Server Plugin stores credentials in plain text

org.jenkins-ci.plugins:groovy

Jenkins Groovy Plugin sandbox bypass vulnerability

org.jenkins-ci.plugins:email-ext

Script security sandbox bypass in Jenkins Email Extension Plugin

com.openmake:deployhub

Jenkins DeployHub Plugin stores credentials in plain text

com.mabl.integration.jenkins:mabl-integration

Jenkins mabl Plugin stores credentials in plain text

org.jenkins-ci.plugins:diawi-upload

Jenkins Diawi Upload Plugin stores credentials in plain text

org.jenkins-ci.plugins:kmap-jenkins

Missing permission check in Jenkins Kmap Plugin allow SSRF

org.jenkins-ci.plugins:jenkins-reviewbot

Missing permission check in Jenkins jenkins-reviewbot Plugin

org.jenkins-ci.plugins:minio-storage

Jenkins Minio Storage Plugin stores credentials in plain text

com.cloudcoreo.plugins:cloudcoreo-deploytime

Jenkins CloudCoreo DeployTime Plugin stores credentials in plain text

org.jenkins-ci.plugins:sametime

Jenkins Sametime Plugin stores credentials in plain text

org.jenkins-ci.plugins:netsparker-cloud-scan

Jenkins Netsparker Enterprise Scan Plugin stored credentials in plain text

org.jenkins-ci.plugins:koji

Jenkins Koji Plugin stores credentials in plain text

org.jenkins-ci.plugins:kmap-jenkins

Jenkins Kmap Plugin stores credentials in plain text

org.jenkins-ci.plugins:relution-publisher

Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials in plain text

hudson.plugins.klaros:klaros-testmanagement

Jenkins Klaros-Testmanagement Plugin stores credentials in plain text

hudson.plugins:starteam

Jenkins StarTeam Plugin stores credentials in plain text

org.jenkins-ci.plugins:crittercism-dsym

Jenkins crittercism-dsym Plugin stores API key in plain text

com.urbancode.ds.jenkins.plugins:sra-deploy

Jenkins Serena SRA Deploy Plugin stores credentials in plain text

org.jenkins-ci.plugins:netsparker-cloud-scan

Missing permission check in Jenkins Netsparker Cloud Scan Plugin

org.jenkins-ci.plugins:assembla-auth

Jenkins Assembla Auth Plugin stores credentials in plain text

org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-coyote

Improper Input Validation in Apache Tomcat

org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina

Apache Tomcat Improper Access Control vulnerability

org.jboss.eap:wildfly-undertow

Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Users could elevate their role when accessing the LTI tool on a provider site

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle XSS Vulnerability

org.jenkins-ci.plugins.workflow:workflow-cps

Sandbox bypass in Jenkins Pipeline: Groovy Plugin

org.apache.struts:struts2-core

Code injection in Apache Struts

org.elasticsearch:elasticsearch, org.elasticsearch:elasticsearch

Improper Access Control in Elasticsearch

org.apache.derby:derby

Improper Restriction of XML External Entity Reference in Apace Derby

org.apache.struts:struts2-core

Server side object manipulation in Apache Struts

org.apache-extras.beanshell:bsh

Improper Input Validation in BeanShell

org.apache.poi:poi-examples

Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability

org.apache.xmlgraphics:batik

Deserialization of Untrusted Data in Apache Batik

org.apache.poi:poi

Improper Restriction of Recursive Entity References in DTDs in Apache POI

com.itextpdf:itextpdf, com.itextpdf:itextpdf, com.lowagie:itext

Improper Restriction of XML External Entity Reference in iText

org.apache.xmlgraphics:batik

Improper Restriction of XML External Entity Reference in Apache Batik

org.bouncycastle:bcprov-jdk15on

Observable Discrepancy in BouncyCastle

ceilometer

Ceilometer Prints Sensitive Configuration Data to Log

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle XSS Vulnerability

symphonycms/symphony-2

Symphony CMS XSS Vulnerabilities

silverstripe/cms, silverstripe/cms

Silverstripe CMS XSS Vulnerability

open-uri-cached

open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution

lxml

Improper Neutralization of Input During Web Page Generation in LXML

moodle/moodle

Moodle does not recogniz configuration setting that makes e-mail addresses visible only to course members

moodle/moodle

Moodle allows remote authenticated users to cause a denial of service (invalid database records)