Open Source Vulnerabilities

Use of Out-of-range Pointer Offset in mruby/mruby

pat, pat, pat, pat, pat

zabbix

Security update for zabbix

Authorization Bypass Through User-Controlled Key in medialize/uri.js

ruby, rubygem-abrt, rubygem-abrt, rubygem-abrt, rubygem-bundler, rubygem-bundler, rubygem-bson, rubygem-bson, rubygem-mongo, rubygem-mongo, rubygem-mysql2, rubygem-mysql2, rubygem-mysql2, rubygem-pg, rubygem-pg

Important: ruby:2.5 security update

ruby, ruby-devel, ruby-doc, ruby-irb, ruby-libs, rubygem-abrt, rubygem-abrt, rubygem-abrt, rubygem-abrt-doc, rubygem-abrt-doc, rubygem-abrt-doc, rubygem-bigdecimal, rubygem-bson, rubygem-bson, rubygem-bson-doc, rubygem-bson-doc, rubygem-bundler, rubygem-bundler, rubygem-bundler-doc, rubygem-bundler-doc, rubygem-did_you_mean, rubygem-io-console, rubygem-json, rubygem-minitest, rubygem-mongo, rubygem-mongo, rubygem-mongo-doc, rubygem-mongo-doc, rubygem-mysql2, rubygem-mysql2, rubygem-mysql2-doc, rubygem-mysql2-doc, rubygem-net-telnet, rubygem-openssl, rubygem-pg, rubygem-pg, rubygem-pg-doc, rubygem-pg-doc, rubygem-power_assert, rubygem-psych, rubygem-rake, rubygem-rdoc, rubygem-test-unit, rubygem-xmlrpc, rubygems, rubygems-devel

Important: ruby:2.5 security update

ruby, rubygem-abrt, rubygem-abrt, rubygem-abrt, rubygem-bson, rubygem-bson, rubygem-mongo, rubygem-mongo, rubygem-mysql2, rubygem-mysql2, rubygem-mysql2, rubygem-pg, rubygem-pg, rubygem-pg

Important: ruby:2.6 security update

ruby, ruby, ruby-devel, ruby-devel, ruby-doc, ruby-doc, ruby-libs, ruby-libs, rubygem-abrt, rubygem-abrt, rubygem-abrt-doc, rubygem-abrt-doc, rubygem-bigdecimal, rubygem-bigdecimal, rubygem-bson, rubygem-bson, rubygem-bson-doc, rubygem-bson-doc, rubygem-bundler, rubygem-bundler, rubygem-did_you_mean, rubygem-did_you_mean, rubygem-io-console, rubygem-io-console, rubygem-irb, rubygem-irb, rubygem-json, rubygem-json, rubygem-minitest, rubygem-minitest, rubygem-mongo, rubygem-mongo, rubygem-mongo-doc, rubygem-mongo-doc, rubygem-mysql2, rubygem-mysql2, rubygem-mysql2-doc, rubygem-mysql2-doc, rubygem-net-telnet, rubygem-net-telnet, rubygem-openssl, rubygem-openssl, rubygem-pg, rubygem-pg, rubygem-pg-doc, rubygem-pg-doc, rubygem-power_assert, rubygem-power_assert, rubygem-psych, rubygem-psych, rubygem-rake, rubygem-rake, rubygem-rdoc, rubygem-rdoc, rubygem-test-unit, rubygem-test-unit, rubygem-xmlrpc, rubygem-xmlrpc, rubygems, rubygems, rubygems-devel, rubygems-devel

Important: ruby:2.6 security update

Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat

expat, expat, expat, libxmltok

expat, expat, expat, expat, expat, expat, expat, expat, expat, expat, expat, expat, expat

expat, expat, expat, expat, expat, expat, expat, expat, expat, expat, expat, expat, expat

expat, expat, expat, libxmltok

ogdi

CVE-2022-25235 affecting package ogdi 4.1.1-3

ogdi

CVE-2022-25235 affecting package ogdi 4.1.0-9

expat

CVE-2022-25235 affecting package expat for versions less than 2.4.8-1

expat

CVE-2022-25236 affecting package expat for versions less than 2.4.8-1

org.postgresql:postgresql

pgjdbc Arbitrary File Write Vulnerability

librenms/librenms

Improper Access Control in librenms

librenms/librenms

Improper Authorization in librenms

librenms/librenms

Missing Authorization in librenms/librenms

librenms/librenms

Cross-site Scripting in librenms

microweber/microweber

Open redirect in microweber

microweber/microweber

Microweber vulnerable to Improper Validation of Specified Quantity in Input

github.com/hashicorp/nomad, github.com/hashicorp/nomad, github.com/hashicorp/nomad

Nomad Spread Job Stanza May Trigger Panic in Servers

org.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins.workflow:workflow-cps

Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Groovy Plugin

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Shared Groovy Libraries Plugin

org.jenkins-ci.plugins.workflow:workflow-multibranch

Jenkins Pipeline: Multibranch Plugin vulnerable to OS Command Injection

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin

org.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins.workflow:workflow-cps, org.jenkins-ci.plugins.workflow:workflow-cps

Improper Link Resolution Before File Access in Jenkins Pipeline: Groovy Plugin

org.jenkins-ci.plugins.workflow:workflow-multibranch, org.jenkins-ci.plugins.workflow:workflow-multibranch, org.jenkins-ci.plugins.workflow:workflow-multibranch, org.jenkins-ci.plugins.workflow:workflow-multibranch

Link Following in Jenkins Pipeline Multibranch Plugin

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure

org.jenkins-ci.plugins.workflow:workflow-cps

Jenkins Pipeline: Groovy Plugin has Insufficiently Protected Credentials

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure

org.jenkins-ci.plugins:pipeline-build-step

Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin

org.jenkins-ci.plugins:generic-webhook-trigger

Stored XSS vulnerability in Jenkins Generic Webhook Trigger Plugin

org.jenkins-ci.plugins:support-core

Jenkins Support Core Plugin stores sensitive data in plain text

com.datapipe.jenkins.plugins:hashicorp-vault-plugin

Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin

org.jenkins-ci.plugins:fortify

Path traversal vulnerability in Jenkins Fortify Plugin

io.jenkins.plugins:custom-checkbox-parameter

Stored Cross-site Scripting vulnerability in Jenkins Custom Checkbox Parameter Plugin

org.conjur.jenkins:conjur-credentials

Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs

io.jenkins.plugins:agent-server-parameter

Stored Cross-site Scripting vulnerability in Jenkins Agent Server Parameter Plugin

io.jenkins.plugins:embotics-vcommander

Jenkins Snow Commander Plugin 2.0 vulnerable to Cross-Site Request Forgery

io.jenkins.plugins:embotics-vcommander

Jenkins Snow Commander Plugin prior to 2.0 vulnerable to Missing Authorization