Archive
July 2017
Vulnerabilities first published in this month (UTC), newest first.
1,269 results · Feed
-
Unscored —
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document.
-
High 8.8
MODX Revolution blind SQL injection
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.
-
High 7.5
Prototype Pollution Protection Bypass in qs
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.
-
Unscored —
Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authe…
-
Unscored —
Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary …
-
Unscored —
Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function
-
Unscored —
MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user
-
High 7.5
Sensitive Cookie Without HttpOnly and Secure Flag
Mautic 2.6.1 and earlier fails to set flags on session cookies
-
High 8.1
Arbitrary Code Execution in Cookie Serialization
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.
-
Unscored —
Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in…
-
Unscored —
Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modificat…
-
Medium 5.9
txAWS AWSServiceEndpoint defaults to not verifying server certificates
txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure.
-
Unscored —
Linux foundation ONOS 1.9.0 is vulnerable to a DoS.
-
High 7.5
phpMyAdmin Cookie attribute injection attack
A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18.
-
Unscored —
Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is st…
-
Medium 6.1
Cross Site Scripting (XSS) in plotly.js
Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.
-
Unscored —
Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user …
-
Medium 6.1
phpMyAdmin CSS Injection Vulnerability
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters
-
Medium 6.1
phpMyAdmin Open Redirect
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness
-
Unscored —
kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS
-
Unscored —
Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure an…
-
Unscored —
Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets.
-
Unscored —
TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature res…
-
Unscored —
xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting…
-
High 7.8
Null Byte Injection in Plug.Static
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.
-
Medium 6.1
Open Redirect in oauth2_proxy
The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819
-
Unscored —
LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalat…
-
Unscored —
ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Appli…
-
Unscored —
JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the …
-
Unscored —
PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in p…
-
High 7.5
FedMsg not properly completing message validation
FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.
-
Unscored —
Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution.
-
Unscored —
rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arb…
-
High 7.5
phpMyAdmin DoS Vulnerability
phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name
-
High 7.5
phpMyAdmin DoS Vulnerability
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality
-
Critical 9.8
Akeneo PIM vulnerable to shell injection in the mass edition
Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.
-
Unscored —
Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack
-
Unscored —
Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration
-
High 8.8
phpMyAdmin SSRF in replication
phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server
-
Unscored —
ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog…