Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-24065PUBLISHED: 2023-01-29
NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for ...
CVE-2023-0565PUBLISHED: 2023-01-29Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2023-0566PUBLISHED: 2023-01-29Static Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2009-10003PUBLISHED: 2023-01-29
A vulnerability was found in capnsquarepants wordcraft up to 0.6. It has been classified as problematic. Affected is an unknown function of the file tag.php. The manipulation of the argument tag leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 0.7 is ...
CVE-2016-15022PUBLISHED: 2023-01-29
A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launche...
User Rank: Strategist
8/15/2018 | 2:41:39 PM
Singling this out as an open-source problem is insufficiently precise. The valid points made here have less to do with open source per se than they do with overall software supply chain.
Further, most closed-source projects are themselves built on top of many layers of open-source components - from Linux to Apache http to Cygwin to the broad spectrum of libraries. This is especially true for security appliances. With open source, you and others can at least verify that you're using current, patched versions of those components - and quickly upgrade them to respond to vulnerabilities, instead of waiting for your vendor's next quarterly/yearly patch/certification cycle.
As a FOSS advocate, it would have been more even-handed of you to have included points such as these as part of your analysis.