Skip to content
OpenAdvisories

Archive

March 2017

Vulnerabilities first published in this month (UTC), newest first.

← February 2017 2017 / March April 2017 →
  1. 158
  2. 248
  3. 350
  4. 48
  5. 516
  6. 616
  7. 764
  8. 8109
  9. 928
  10. 1024
  11. 119
  12. 1212
  13. 1315
  14. 1464
  15. 1588
  16. 1620
  17. 17180
  18. 183
  19. 193
  20. 2063
  21. 2122
  22. 2229
  23. 23105
  24. 2447
  25. 251
  26. 269
  27. 2759
  28. 2839
  29. 2932
  30. 3045
  31. 3136
All Critical High Medium Low Exploited only Public exploit

39 results · Clear filters · Feed

  • Medium 4.8
    CVE-2017-7309 EPSS 63%

    MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php

    A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.…

    mantisbt/mantisbt Packagist
  • Medium 4.8
    CVE-2017-7241

    MantisBT XSS via move_attachments_page.php

    A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) setting…

    mantisbt/mantisbt Packagist
  • Medium 4.8
    CVE-2017-6973

    MantisBT XSS via adm_config_report.php's action parameter

    A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.

    mantisbt/mantisbt Packagist
  • Medium 5.5
    CVE-2016-4976

    Apache Ambari reveals administrator passwords

    Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing.

    org.apache.ambari:ambari Maven
  • Medium 5.5
    CVE-2015-8234

    OpenStack Glance Signature Verification Bypass

    The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.

    glance glance Debian PyPI
  • Medium 5.4
    CVE-2017-7298

    Moodle Cross-site Scripting in the Course summary filter of the Add a new course

    In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element.

    moodle/moodle Packagist
  • Medium 6.1
    CVE-2017-7271

    Yii Framework Reflected XSS

    Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.

    yiisoft/yii2 Packagist
  • Medium 5.4
    CVE-2015-8310

    Cherry Music Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.

    cherrymusic PyPI
  • Medium 4.3
    CVE-2015-8309 Public exploit

    Cherry Music directory traversal vulnerability

    Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

    cherrymusic PyPI
  • Medium 5.3
    CVE-2017-2643

    Moodle Global search displays user names for unauthenticated users

    In Moodle 3.2.x, global search displays user names for unauthenticated users.

    moodle/moodle Web / CMS Packagist
  • Medium 6.1
    CVE-2017-2645

    Moodle XSS in attachments to evidence of prior learning

    In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.

    moodle/moodle Web / CMS Packagist
  • Medium 6.1
    CVE-2017-2644

    Moodle XSS Vulnerability

    In Moodle 3.x, XSS can occur via evidence of prior learning.

    moodle/moodle Web / CMS Packagist
  • Medium 5.3
    CVE-2017-7264

    Use-after-free vulnerability in the fz_subsample_pixmap function in fitz/pixmap.c in Artifex MuPDF 1.10a allows remote …

    mupdf mupdf Debian Ubuntu
  • Medium 6.1
    CVE-2017-7266

    Netflix Security Monkey Open Redirect vulnerability

    Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.

    security-monkey PyPI
  • Medium 5.5
    CVE-2017-5644

    Improper Restriction of Recursive Entity References in DTDs in Apache POI

    Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

    Apache Software Foundation Apache POI libapache-poi-java org.apache.poi:poi Debian Ubuntu Maven
  • Medium 6.1
    CVE-2017-7251

    Pi Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the "pi-develop/www/script/editor/markitup/preview/markdown.php" URL. An attacker could execut…

    pi/pi Packagist
  • Medium 6.5
    CVE-2014-0229

    Improper Authentication in Apache Hadoop

    Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated…

    org.apache.hadoop:hadoop-common Maven
  • Medium 4.3
    CVE-2017-5524

    Plone Sandbox Escape

    Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.

    plone PyPI
  • Medium 5.8
    CVE-2017-7200

    OpenStack Glance Server-Side Request Forgery (SSRF)

    An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. Th…

    glance glance glance Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2017-7204

    imdbphp Cross-Site Scripting (XSS)

    A Cross-Site Scripting (XSS) was discovered in imdbphp 5.1.1. The vulnerability exists due to insufficient filtration of user-supplied data (name) passed to the "imdbphp-master/demo/search.php" URL. An attacker could execute arbitrary HTML and script code in …

    imdbphp/imdbphp Packagist
  • Medium 5.3
    CVE-2017-6370 Public exploit

    TYPO3 Information Disclosure Vulnerability

    TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.

    typo3/cms Packagist
  • Medium 4.3
    CVE-2017-6954

    BuddyPress Docs plugin Improper Privilege Management

    An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.

    buddypress/buddypress Packagist
  • Medium 4.3
    CVE-2017-0059 Exploited Public exploit EPSS 62%

    Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via…

    Microsoft Internet Explorer
    KEV Mar 28, 2022
  • Medium 6.5
    CVE-2017-0022 Exploited EPSS 18%

    Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Win…

    Microsoft XML Core Services
    KEV May 24, 2022
  • Medium 5.3
    CVE-2017-5537

    Weblate user account enumeration via reset password form

    The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.

    weblate PyPI
  • Medium 6.1
    CVE-2016-7103 EPSS 29%

    jQuery-UI vulnerable to Cross-site Scripting in dialog closeText

    Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

    drupal7 jQuery.UI.Combined org.webjars.npm:jquery-ui jqueryui Debian Ubuntu Alpine npm Maven NuGet RubyGems
  • Medium 5.3
    CVE-2017-2786

    A denial of service vulnerability exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A…

    Pharos PopUp Printer Client
  • Medium 6.1
    CVE-2017-6591

    django-epiceditor vulnerable to XSS in form field

    There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.

    django-epiceditor PyPI
  • Medium 6.1
    CVE-2017-6589

    EpicEditor XSS Vulnerability

    EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document.

    epiceditor npm
  • Medium 6.1
    CVE-2017-6511

    andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the ac…

  • Medium 6.1
    CVE-2016-7138

    Plone XSS

    Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

    plone PyPI
  • Medium 6.1
    CVE-2016-7136

    Plone XSS

    z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request.

    plone PyPI
  • Medium 6.1
    CVE-2016-7140

    Plone vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    plone PyPI
  • Medium 6.1
    CVE-2016-7137

    Plone Open Redirect Vulnerability

    Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) %2b%2bgro…

    plone PyPI
  • Medium 4.9
    CVE-2016-7135

    Plone vulnerable to filesystem information leak

    Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.fi…

    plone PyPI
  • Medium 6.1
    CVE-2016-7139

    Plone Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

    plone PyPI
  • Medium 5.3
    CVE-2016-4947

    Cloudera HUE Account Enumeration

    Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.

    gethue npm
  • Medium 6.1
    CVE-2017-5197

    Silverstripe CMS XSS Vulnerability

    There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.

    silverstripe/cms Packagist
  • Medium 6.1
    CVE-2017-6484

    INTER-Mediator Cross-Site Scripting (XSS)

    Multiple Cross-Site Scripting (XSS) issues were discovered in INTER-Mediator 5.5. The vulnerabilities exist due to insufficient filtration of user-supplied data (c and cred) passed to the "INTER-Mediator-master/Auth_Support/PasswordReset/resetpassword.php" UR…

    inter-mediator/inter-mediator Packagist