Open Source Vulnerabilities

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Improper Access Control

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle provides calendar-event data without considering whether an activity is hidden

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle sensitive information disclosure

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle allows attackers to obtain sensitive category-detail information

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Reflected XSS in mod_data advanced search

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle allows attackers to discover student e-mail addresses

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Cross-site request forgery (CSRF) vulnerability

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle sensitive information disclosure

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Incorrect Authorization in Jenkins

org.keycloak:keycloak-parent

Keycloak Improper Bruteforce Detection

org.jboss.eap:wildfly-undertow

Improper Limitation of a Pathname to a Restricted Directory in Jboss EAP Undertow

github.com/openshift/oauth-apiserver

Withdrawn Advisory: OpenShift OAuth Server XSS Vulnerability

io.undertow:undertow-core

Exposure of Sensitive Information to an Unauthorized Actor in Undertow

statamic/cms

Statamic framework Incorrect Permission Assignment

com.ning:async-http-client

Insufficient Verification of Data Authenticity in Async Http Client

com.ning:async-http-client

Insufficient Verification of Data Authenticity in Async Http Client

bolt/bolt

Bolt Unrestricted Upload of File with Dangerous Type

bolt/bolt

Bolt Cross Site Request Forgery (CSRF)

bolt/bolt

Bolt Improper Access Control

org.apache.tomcat:tomcat

Apache Tomcat Unrestricted file upload vulnerability

inter-mediator/inter-mediator

INTER-Mediator Cross-Site Scripting (XSS)

pagekit/pagekit

Pagekit Weak Password Recovery Mechanism for Forgotten Password

oxid-esales/oxideshop-ce

OXID eShop user impersonation vulnerability

oauthenticator, oauthenticator

JupyterHub OAuthenticator elevation of privilege

org.springframework.ldap:spring-ldap-core

Improper Authentication in Pivotal Spring-LDAP

mautic/core

Mautic Cross-Site Request Forgery (CSRF)

org.codehaus.plexus:plexus-utils

OS Command Injection in Plexus-utils

org.hornetq:hornetq-server, org.apache.activemq:artemis-native

Uncontrolled Resource Consumption in Artemis and HornetQ

org.apache.activemq:artemis-pom

Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain

dolibarr/dolibarr

Dolibarr SQL Injection vulnerability

com.squareup.okhttp3:okhttp, com.squareup.okhttp3:okhttp

Improper Certificate Validation in OkHttp

io.netty:netty-handler, io.netty:netty-handler

Loop with Unreachable Exit Condition in Netty

org.igniterealtime.smack:smack-core

Smack allows the bypass of TLS protections

horizon

Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

org.apache.activemq:activemq-openwire-generator, org.apache.activemq:activemq-parent, org.apache.activemq:activemq-parent

ActiveMQ's OpenWire protocol exposes certain system details as plain text

horizon

OpenStack Horizon Cross-site scripting (XSS) vulnerability

horizon

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface

pip

Improper Link Resolution Before File Access in pip

pip

pip lack of randomness in build directory

pip

Improper Input Validation in pip

django-crm

MicroPyramid Django-CRM CSRF

requests

Python Requests Session Fixation

jqueryfiletree

jqueryFileTree vulnerable to Directory Traversal

dapphp/securimage

Securimage HTML Injection

codiad/codiad

Codiad remote code execution vulnerability

org.apache.knox:gateway-provider-identity-assertion-common

Apache Knox allows impersonation of users

org.apache.sling:org.apache.sling.api, org.apache.sling:org.apache.sling.servlets.post

Improper Neutralization of Input During Web Page Generation in Apache Sling

aoe/restler, luracast/restler

Luracast Restler directory traversal vulnerability

commons-httpclient:commons-httpclient

Improper Certificate Validation in Apache Commons HttpClient

mixlib-archive

mixlib-archive Path Traversal vulnerability