GHSA-XM92-RF24-H74W Apache Geronimo Application Server multiple directory traversal vulnerabilities

Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the 1 group, 2 artifact, 3 version, or 4 fileType...

ThinkPHP SQLi Vulnerability

ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable...

org.sonarsource.sonarqube:sonar-ce (5.6-rc1), org.sonarsource.sonarqube:sonar-core (5.6-rc1) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (5.6-rc1)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 5.6-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-ce 5.6-rc1 -...

org.sonarsource.sonarqube:sonar-batch (5.4-rc2), org.sonarsource.sonarqube:sonar-batch-protocol (5.4-rc2) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (5.4-rc2)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 5.4-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-batch 5.4-rc2 -...

org.sonarsource.sonarqube:sonar-ce (6.0-rc1), org.sonarsource.sonarqube:sonar-core (6.0-rc1) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (6.0-rc1)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 6.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-ce 6.0-rc1 -...

org.sonarsource.sonarqube:sonar-ce (5.5-rc1), org.sonarsource.sonarqube:sonar-core (5.5-rc1) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (5.5-rc1)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 5.5-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-ce 5.5-rc1 -...

org.sonarsource.sonarqube:sonar-ce (5.6.5), org.sonarsource.sonarqube:sonar-core (5.6.5) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (5.6.5)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 5.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-ce 5.6.5 -...

org.sonarsource.sonarqube:sonar-ce (6.2-rc1), org.sonarsource.sonarqube:sonar-core (6.2-rc1) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (6.2-rc1)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 6.2-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-ce 6.2-rc1 -...

com.github.rigoford:sonar-java-rules (>=0.1.0, <=0.3.0), org.sonarsource.sonarqube:sonar-ce (6.2.1) +7 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (6.2.1)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - com.github.rigoford:sonar-java-rules =0.1.0, =0.3.0 -...

org.sonarsource.sonarqube:sonar-batch (5.4-rc4), org.sonarsource.sonarqube:sonar-batch-protocol (5.4-rc4) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (5.4-rc4)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 5.4-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-batch 5.4-rc4 -...

org.sonarsource.sonarqube:sonar-ce (5.6-rc2), org.sonarsource.sonarqube:sonar-core (5.6-rc2) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (5.6-rc2)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 5.6-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-ce 5.6-rc2 -...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2018-1999006 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2018-1999045 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2018-1000409 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2018-1000407 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2017-1000398 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

org.apache.empire-db:empire-db-codegen (2.0.6-incubating), org.apache.empire-db:empire-db-maven-plugin (2.0.6-incubating) potentially affected by CVE-2018-3258 via mysql:mysql-connector-java (5.1.1)

mysql:mysql-connector-java MAVEN version 5.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mysql:mysql-connector-java and may be impacted: - org.apache.empire-db:empire-db-codegen 2.0.6-incubating - org.apache.empire-db:empire-db-maven-plugin...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2018-1000864 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2017-1000400 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

GHSA-6MXM-WPQV-675H Moodle XSS from profile fields from external db

Multiple cross-site scripting XSS vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field...