Open Source Vulnerabilities

org.cloudfoundry.identity:cloudfoundry-identity-server

Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint

intelliants/subrion

Subrion CMS RCE Vulnerability

org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server, org.cloudfoundry.identity:cloudfoundry-identity-server

Cloud Foundry UAA Denial of Service through client token revocation endpoint

k8s.io/kubernetes

Kubernetes in OpenShift3 Access Control Misconfiguration

org.springframework.social:spring-social-core

springframework-social Cross-Site Request Forgery vulnerability

com.jcraft:jsch

Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch

urllib3

Improper Neutralization of CRLF Sequences in urllib3 library for Python

org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-frontend-jaxrs

Improper Input Validation in Apache CXF

org.apache.cxf:cxf, org.apache.cxf:cxf, org.apache.cxf:cxf

XML Signature/Encryption Not Validated in Apache CXF

org.apache.cxf:cxf, org.apache.cxf:cxf

Improper Authentication in Apache CXF

org.apache.cxf:cxf, org.apache.cxf:cxf, org.apache.cxf:cxf

Improper Authentication in Apache CXF

org.apache.cxf:cxf, org.apache.cxf:cxf, org.apache.cxf:cxf

Remote web-service operation execution in Apache CXF

org.apache.cxf:cxf-rt-transports-http, org.apache.cxf:cxf-rt-transports-http, org.apache.cxf:cxf-rt-transports-http

Inadequate Encryption Strength in Apache CXF

org.apache.cxf.karaf:apache-cxf, org.apache.cxf.karaf:apache-cxf

Covert Timing Channel in Apache CXF

org.apache.cxf:cxf, org.apache.cxf:cxf, org.apache.cxf:cxf

Improper Authentication in Apache CXF

org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-frontend-jaxrs

Missing XML Validation in Apache CXF

org.apache.cxf:cxf-rt-rs-security-sso-saml, org.apache.cxf:cxf-rt-rs-security-sso-saml, org.apache.cxf:cxf-rt-rs-security-sso-saml

Improper Access Control in Apache CXF

org.apache.cxf:cxf-rt-ws-security, org.apache.cxf:cxf-rt-ws-security

Improper Input Validation in Apache CXF

org.apache.cxf:cxf-core, org.apache.cxf:cxf-core

Uncontrolled Resource Consumption in Apache CXF

org.apache.cxf:cxf-core, org.apache.cxf:cxf-core

Uncontrolled Resource Consumption in Apache CXF

org.apache.cxf:cxf-core, org.apache.cxf:cxf-core, org.apache.cxf:cxf-core

Improper Input Validation in Apache CXF

org.apache.ws.security:wss4j, org.apache.wss4j:wss4j-ws-security-dom

Improper Authentication in Apache WSS4J

org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-frontend-jaxrs

Loop with Unreachable Exit Condition in Apache CXF

org.apache.cxf:cxf-core, org.apache.cxf:cxf-core

Cleartext Transmission of Sensitive Information in Apache CXF

org.apache.cxf:cxf-core, org.apache.cxf:cxf-core

Improper Neutralization of Input During Web Page Generation in Apache CXF

org.apache.cxf:cxf-core, org.apache.cxf:cxf-core

Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS

org.apache.cxf.fediz:fediz-oidc

Cross-Site Request Forgery in Apache CXF Fediz

org.apache.cxf:cxf-core, org.apache.cxf:cxf-core

Improper Certificate Validation in Apache CXF

org.apache.cxf:cxf-core, org.apache.cxf:cxf-core

Session Fixation in Apache CXF

github.com/apache/trafficcontrol, github.com/apache/trafficcontrol, github.com/apache/trafficcontrol, github.com/apache/trafficcontrol, github.com/apache/trafficcontrol

Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack

org.apache.hadoop:hadoop-common, org.apache.hadoop:hadoop-common

Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop

org.apache.hadoop:hadoop-client

Improper Input Validation in Apache Hadoop

org.apache.hadoop:hadoop-client

Improper Neutralization of Input During Web Page Generation in Apache Hadoop

baserproject/basercms

baserCMS Access Control Bypass

baserproject/basercms

BaserCMS privilege escallation

qpid-python

Apache Qpid Python client Improper certificate validation

concrete5/concrete5

Concrete CMS vulnerable to cross-site scripting (XSS)

node-inspector

Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding

org.apache.zookeeper:zookeeper, org.apache.zookeeper:zookeeper

Uncontrolled Resource Consumption in Apache ZooKeeper

irisnet-crypto

irisnet-crypto RCE Vulnerability

matrix-synapse

Matrix Synapse Predictable Secret Key

com.nablarch.framework:nablarch-fw-web

Nablarch Incomplete Cryptography

nnabla

Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10

contao/contao, contao/core-bundle

Contao Does Not Expire Tokens Correctly

hex_core

Hex authenticity of signed packages not validated

bootstrap, bootstrap, bootstrap, bootstrap, org.webjars:bootstrap, org.webjars:bootstrap, bootstrap, bootstrap, bootstrap.sass, bootstrap-sass, twbs/bootstrap, twbs/bootstrap

Bootstrap vulnerable to Cross-Site Scripting (XSS)

org.apache.xmlgraphics:fop

Improper Restriction of XML External Entity Reference in Apache FOP

ezyang/htmlpurifier

HTML Purifier cross-site scripting (XSS) vulnerability

github.com/traefik/traefik

Traefik Missing Authentication

org.apache.geronimo:geronimo

Apache Geronimo Hash Collisions Cause DoS