CVE-2024-1597 vulnerabilities

Vulnerabilities for packages: mariadb, trino, dependency-track, keycloak...

GHSA-4265-CCF5-PHJ5 vulnerabilities

Vulnerabilities for packages: celeborn, tez, trino, hadoop-client-modules, kayenta-fips, wavefront-proxy, gradle, kayenta, opensearch, hadoop-fips, dependency-track, spdx-tools-java, druid...

GHSA-4265-CCF5-PHJ5 vulnerabilities

Vulnerabilities for packages: trino, druid, dependency-track, celeborn, opensearch, tez, wavefront-proxy, spdx-tools-java, gradle...

GHSA-4G9R-VXHX-9PGX vulnerabilities

Vulnerabilities for packages: trino, druid, dependency-track, celeborn, opensearch, tez, wavefront-proxy, spdx-tools-java, gradle...

CVE-2024-26308 vulnerabilities

Vulnerabilities for packages: trino, druid, dependency-track, celeborn, opensearch, tez, wavefront-proxy, spdx-tools-java, gradle...

CVE-2024-26308 vulnerabilities

Vulnerabilities for packages: celeborn, tez, trino, hadoop-client-modules, kayenta-fips, wavefront-proxy, gradle, kayenta, opensearch, hadoop-fips, dependency-track, spdx-tools-java, druid...

CVE-2024-25710 vulnerabilities

Vulnerabilities for packages: trino, druid, dependency-track, celeborn, opensearch, tez, wavefront-proxy, spdx-tools-java, gradle...

CVE-2024-25710 vulnerabilities

Vulnerabilities for packages: celeborn, tez, trino, hadoop-client-modules, kayenta-fips, wavefront-proxy, gradle, kayenta, opensearch, hadoop-fips, dependency-track, spdx-tools-java, druid...

GHSA-GVPG-VGMX-XG6W vulnerabilities

Vulnerabilities for packages: celeborn, elasticsearch, tez, thingsboard, hadoop-client-modules, sonarqube-10, dependency-track, druid...

GHSA-GVPG-VGMX-XG6W vulnerabilities

Vulnerabilities for packages: druid, tez, dependency-track, celeborn, thingsboard, sonarqube-10...

CVE-2023-52428 vulnerabilities

Vulnerabilities for packages: celeborn, elasticsearch, tez, thingsboard, hadoop-client-modules, sonarqube-10, dependency-track, druid...

CVE-2023-52428 vulnerabilities

Vulnerabilities for packages: druid, tez, dependency-track, celeborn, thingsboard, sonarqube-10...

PT-2023-16762 · Unknown · Dependency-Track-Policy-Applier

Name of the Vulnerable Software and Affected Versions: dependency-track-policy-applier affected versions not specified Description: The issue concerns the management of OWASP Dependency-Track policy. It involves creating a policy with projects and tags and adding conditions. Recommendations: At t...

GHSA-C33W-PM52-MQVF @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details

Description Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library Showdown. Showdown does not have any XSS countermeasures built in, and versions before 4.6.1 of the Dependency-Track frontend did n...

CVE-2022-39350

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...

CVE-2022-39351

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

Format string

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...

Design/Logic Flaw

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

Dependency-Track 安全漏洞

Dependency-Track is an intelligent supply chain component analysis platform for identifying third-party component risks. A security vulnerability exists in versions of Dependency-Track prior to 4.6.1 that stems from not coding or cleaning up the output of Showdown, which allows arbitrary JavaScri...

CVE-2022-39351: Cleartext Storage of Sensitive Information

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...