Skip to content
OpenAdvisories

Archive

February 2017

Vulnerabilities first published in this month (UTC), newest first.

← January 2017 2017 / February March 2017 →
  1. 1143
  2. 215
  3. 344
  4. 43
  5. 53
  6. 632
  7. 734
  8. 886
  9. 952
  10. 109
  11. 11 
  12. 126
  13. 13124
  14. 144
  15. 1592
  16. 1628
  17. 1759
  18. 183
  19. 19 
  20. 20154
  21. 2121
  22. 2241
  23. 2311
  24. 2434
  25. 25 
  26. 261
  27. 2730
  28. 2812
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Medium 4.9
    CVE-2016-4043

    Chameleon in Plone allows Authentication Bypass

    Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.

    plone PyPI
  • Medium 5.3
    CVE-2016-4042

    Plone vulnerable to unauthorized disclosure of site content

    Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.

    plone PyPI
  • Medium 6.1
    CVE-2017-6099

    PayPal PHP Merchant SDK Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.

    paypal/merchant-sdk-php Packagist
  • Medium 6.1
    CVE-2016-9909

    Improper Neutralization of Input During Web Page Generation in html5lib

    The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.

    html5lib html5lib html5lib Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2016-9910

    Cross-site Scripting in html5lib

    The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909.

    html5lib html5lib html5lib Debian Ubuntu PyPI
  • Medium 4.7
    CVE-2016-7111

    MantisBT XSS through weak CSP when using Gravatar plugin

    MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

    mantisbt/mantisbt Packagist
  • Medium 4.9
    CVE-2016-4314 Public exploit EPSS 12%

    WSO2 Carbon directory traversal vulnerability

    Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.

    org.wso2.carbon.commons:org.wso2.carbon.logging.view.ui Maven
  • Medium 6.1
    CVE-2016-4316 Public exploit

    WSO2 Carbon vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-lis…

    org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui Maven
  • Medium 6.3
    CVE-2016-9955

    Incorrect signature verification in SimpleSAMLphp

    The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values t…

    simplesamlphp simplesamlphp simplesamlphp/simplesamlphp Debian Ubuntu Packagist
  • Medium 5.9
    CVE-2016-6210 Public exploit EPSS 89%

    sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static…

    openssh openssh openssh Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2017-5591

    SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons

    An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…

    slixmpp slixmpp sleekxmpp sleekxmpp Debian Ubuntu PyPI
  • Medium 5.9
    CVE-2017-5605

    XMPP Clients User Impersonation Vulnerability in Movim Moxl

    An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…

    movim/moxl Packagist
  • Medium 5.9
    CVE-2017-5858

    User Impersonation in converse.js

    An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…

    converse.js npm
  • Medium 6.5
    CVE-2016-4987

    Jenkins Image Gallery Plugin allows Path Traversal

    Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields.

    com.tupilabs.image_gallery:image-gallery Maven
  • Medium 6.1
    CVE-2016-4988

    Cross-site Scripting in Jenkins Build Failure Analyzer plugin

    Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

    com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer Maven
  • Medium 5.4
    CVE-2016-3101

    Jenkins Extra Columns Plugin allows Cross-Site Scripting (XSS)

    Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by leveraging failure to filter tool tips through the configured markup formatter.

    org.jenkins-ci.plugins:extra-columns Maven
  • Medium 5.3
    CVE-2016-3124

    SimpleSAMLphp Information leakage issue in the sanitycheck module

    The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.

    simplesamlphp simplesamlphp simplesamlphp/simplesamlphp Debian Ubuntu Packagist
  • Medium 4.6
    CVE-2016-2781

    chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TI…

    coreutils coreutils Debian Ubuntu
  • Medium 6.1
    CVE-2016-7147

    Plone XSS in Zope ZMI

    Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as de…

    plone zope2.13 Ubuntu PyPI