4 April 2017

5 results · Clear filters · Feed

• Medium 5.3
  CVE-2017-0360

  Tryton Information Disclosure Vulnerability

  file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.

  trytond tryton-server tryton-server Debian Ubuntu PyPI
  Apr 4, 2017
• Medium 6.1
  CVE-2017-7234

  Django open redirect

  A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Apr 4, 2017
• Medium 6.1
  CVE-2017-7233

  Django open redirect and possible XSS attack via user-supplied numeric redirect URLs

  Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URL…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Apr 4, 2017
• Medium 4.6
  CVE-2017-7305

  Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate atta…

  Apr 4, 2017
• Medium 6.4
  CVE-2017-7306

  Riverbed RiOS through 9.6.0 has a weak default password for the secure vault, which makes it easier for physically prox…

  Apr 4, 2017