Open Source Vulnerabilities

qtwebkit-opensource-src, webkit2gtk, qtwebkit-source, webkitgtk, webkit2gtk, qtwebkit-opensource-src, qtwebkit-source, webkitgtk, webkit2gtk, qtwebkit-opensource-src, wpewebkit, qtwebkit-opensource-src, webkit2gtk, wpewebkit, qtwebkit-opensource-src

qtwebkit-opensource-src, webkit2gtk, qtwebkit-source, webkitgtk, webkit2gtk, qtwebkit-opensource-src, qtwebkit-source, webkitgtk, webkit2gtk, qtwebkit-opensource-src, wpewebkit, qtwebkit-opensource-src, webkit2gtk, wpewebkit, qtwebkit-opensource-src

qtwebkit-opensource-src, webkit2gtk, qtwebkit-source, webkitgtk, webkit2gtk, qtwebkit-opensource-src, qtwebkit-source, webkitgtk, webkit2gtk, qtwebkit-opensource-src, wpewebkit, qtwebkit-opensource-src, webkit2gtk, wpewebkit, qtwebkit-opensource-src

mixme

Prototype Pollution in mixme

handlebars

Prototype Pollution in handlebars

git-parse

Command injection in git-parse

install-package

OS Command Injection in install-package

git-add-remote

OS Command Injection in git-add-remote

koa-remove-trailing-slashes

Open Redirect in koa-remove-trailing-slashes

matrix-react-sdk

Improper file handling in matrix-react-sdk

vmd

Cross-site Scripting in vmd

node-key-sender

OS Command Injection in node-key-sender

effect

Withdrawn Advisory: OS Command Injection in effect

op-browser

Injection in op-browser

karma-mojo

karma-mojo enables OS Command Injection

aurelia-framework

Cross-site Scripting in aurelia-framework

@rkesters/gnuplot

Code injection in @rkesters/gnuplot

jscover

OS Command Injection in jscover

strong-nginx-controller

OS Command Injection in strong-nginx-controller

express-handlebars

Insecure template handling in Express-handlebars

chownr

Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

froala-editor

DOM-based cross-site scripting in Froala Editor

ajv

Prototype Pollution in Ajv

bson

Deserialization of Untrusted Data in bson

org.apache.tomee:tomee, org.apache.tomee:tomee, org.apache.tomee:tomee, org.apache.tomee:tomee

Missing Authentication for Critical Function in Apache TomEE

com.netflix.conductor:conductor-core

Expression Language Injection in Netflix Conductor

org.apache.archiva:archiva

Injection in Apache Archiva

org.apache.spark:spark-parent_2.11, pyspark

Improper Authentication in Apache Spark

org.hibernate:hibernate-core, org.hibernate:hibernate-core, org.hibernate:hibernate-core

SQL Injection in Hibernate ORM

org.apache.karaf.management:org.apache.karaf.management.server

Server-Side Request Forgery in Karaf

com.mikesamuel:json-sanitizer

Cross-site scripting in json-sanitizer

org.jodd:jodd-json

Deserialization of Untrusted Data in Jodd

net.minidev:json-smart, net.minidev:json-smart

Out of bounds read in json-smart

org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-tool-configuration-resources, org.xwiki.platform:xwiki-platform-tool-configuration-resources

Cross-site Scripting by SVG upload in xwiki-platform

org.xwiki.platform:xwiki-platform-administration-ui, org.xwiki.platform:xwiki-platform-administration-ui

Cross-Site Request Forgery in xwiki-platform

org.graylog:graylog-parent

Improper Certificate Validation in Graylog

org.apache.dubbo:dubbo, org.apache.dubbo:dubbo-common

Deserialization of Untrusted Data in Apache Dubbo

org.apache.cxf:cxf-rt-management, org.apache.cxf:cxf-rt-management

Apache CXF JMX Integration is vulnerable to a MITM attack

coherence

Permissive parameters and privilege escalation

terminal42/contao-tablelookupwizard

Possible SQL injection in tablelookupwizard Contao Extension

forkcms/forkcms

Cross-site scripting in forkcms

concrete5/concrete5

Unrestricted Uploads in Concrete5

cakephp/cakephp, cakephp/cakephp

Cross-Site Request Forgery in CakePHP

francoisjacquet/rosariosis

Cross-site Scripting in RosarioSIS