Skip to content
OpenAdvisories

Archive

13 July 2017

Vulnerabilities first published on this day (UTC), newest first.

← June 2017 2017 / July /13 August 2017 →
  1. 12
  2. 212
  3. 315
  4. 430
  5. 5180
  6. 669
  7. 774
  8. 88
  9. 93
  10. 1033
  11. 1163
  12. 1239
  13. 1392
  14. 1472
  15. 15 
  16. 1613
  17. 1758
  18. 1828
  19. 1930
  20. 2087
  21. 2135
  22. 2213
  23. 2335
  24. 2437
  25. 2554
  26. 2636
  27. 2729
  28. 2830
  29. 2912
  30. 3014
  31. 3166
All Critical High Medium Low Exploited only Public exploit

92 results · Feed

  • Unscored —
    CVE-2017-1000032

    Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTM…

    cacti cacti Debian Ubuntu
  • Unscored —
    CVE-2017-1000054

    Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.

  • High 7.5
    CVE-2017-1000026

    mixlib-archive Path Traversal vulnerability

    Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries

    mixlib-archive ruby-mixlib-archive Debian RubyGems
  • High 8.1
    CVE-2017-1000034

    Akka Java Serialization vulnerability

    Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.

    com.typesafe.akka:akka-actor Maven
  • Unscored —
    CVE-2017-1000029 Scanner template

    Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that…

  • Unscored —
    CVE-2017-1000031

    SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary …

    cacti cacti Debian Ubuntu
  • Medium 6.1
    CVE-2017-1000043

    Content Injection via TileJSON Name in mapbox.js

    Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control

    mapbox-rails mapbox.js npm RubyGems
  • Unscored —
    CVE-2017-1000051

    Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to i…

  • Unscored —
    CVE-2017-1000028 Public exploit Scanner template EPSS 99%

    Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trav…

  • Unscored —
    CVE-2017-1000011

    MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or ste…

  • Unscored —
    CVE-2017-1000025

    GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior version…

    epiphany-browser epiphany-browser epiphany Debian Ubuntu
  • Unscored —
    CVE-2017-1000065

    Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Managemen…

  • Unscored —
    CVE-2017-1000021

    LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.

  • Unscored —
    CVE-2017-1000020

    SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos…

  • Unscored —
    CVE-2017-1000062

    kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution

  • Unscored —
    CVE-2017-1000058

    Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data par…

  • Unscored —
    CVE-2017-1000033

    Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission r…

    Web / CMS
  • Unscored —
    CVE-2017-1000044

    gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memo…

    gtk-vnc Debian
  • Unscored —
    CVE-2017-1000066

    The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, wh…

  • Unscored —
    CVE-2017-1000081

    Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code exe…

  • Unscored —
    CVE-2017-1000071

    Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to a…

    php-cas php-cas Debian Ubuntu
  • Unscored —
    CVE-2017-1000030

    Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulne…

  • Unscored —
    CVE-2017-1000074

    Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.

  • Unscored —
    CVE-2017-1000002 Public exploit EPSS 31%

    ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course…

  • Unscored —
    CVE-2017-1000024

    Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishi…

    shotwell shotwell Debian Ubuntu
  • Critical 9.8
    CVE-2017-1000056

    Kubernetes Privilege Escalation

    Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

    k8s.io/kubernetes kubernetes Debian Go
  • Critical 9.8
    CVE-2017-1000362

    Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

    The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed …

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2017-1000060

    EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root

  • Unscored —
    CVE-2017-1000038

    WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute Jav…

    Web / CMS
  • High 8.8
    CVE-2017-1000069

    Cross-site Request Forgery (CSRF)

    CSRF in Bitly oauth2_proxy 2.1 during authentication flow

    github.com/bitly/oauth2_proxy Go
  • Unscored —
    CVE-2017-1000063

    kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure

  • Unscored —
    CVE-2017-1000023

    LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document.

  • High 8.8
    CVE-2017-1000067

    MODX Revolution blind SQL injection

    MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.

    modx/revolution Packagist
  • High 7.5
    CVE-2017-1000048

    Prototype Pollution Protection Bypass in qs

    the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

    nodejs-nodemon qs Azure Linux npm
  • Unscored —
    CVE-2017-1000008

    Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authe…

  • Unscored —
    CVE-2017-1000073

    Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary …

  • Unscored —
    CVE-2017-1000075

    Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function

  • Unscored —
    CVE-2017-1000012

    MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user

  • High 7.5
    CVE-2017-1000046

    Sensitive Cookie Without HttpOnly and Secure Flag

    Mautic 2.6.1 and earlier fails to set flags on session cookies

    mautic/core Packagist
  • High 8.1
    CVE-2017-1000053

    Arbitrary Code Execution in Cookie Serialization

    Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.

    plug Hex