Skip to content
OpenAdvisories

Archive

August 2017

Vulnerabilities first published in this month (UTC), newest first.

← July 2017 2017 / August September 2017 →
  1. 129
  2. 268
  3. 313
  4. 438
  5. 523
  6. 610
  7. 7118
  8. 8316
  9. 984
  10. 1025
  11. 11100
  12. 12 
  13. 13 
  14. 1420
  15. 156
  16. 1620
  17. 1735
  18. 18176
  19. 195
  20. 205
  21. 2118
  22. 2226
  23. 2333
  24. 2436
  25. 2536
  26. 261
  27. 274
  28. 28104
  29. 2998
  30. 3051
  31. 3142
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.8
    CVE-2017-0899 EPSS 11%

    RubyGems Code Injection vulnerability

    RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.

    HackerOne RubyGems ruby2.3 ruby Debian Ubuntu Alpine RubyGems
  • Critical 9.8
    CVE-2017-10842

    baserCMS SQL Injection vulnerability

    SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    baserCMS Users Community BaserCMS baserproject/basercms Packagist
  • Critical 9.8
    CVE-2017-11317 Exploited Public exploit EPSS 84%

    Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUploa…

    KEV Apr 11, 2022
  • Critical 9.8
    CVE-2017-11357 Exploited · Ransomware Public exploit EPSS 78%

    Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which …

    KEV Jan 26, 2023
  • Critical 9.8
    CVE-2015-5224

    The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name col…

    util-linux Debian
  • Critical 9.8
    CVE-2017-12791

    SaltStack Salt Directory traversal vulnerability in minion id validation

    Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

    salt salt Ubuntu PyPI
  • Critical 9.8
    CVE-2017-11366 Public exploit

    Codiad Vulnerable to Shell Command Injection

    components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.

    codiad/codiad Packagist
  • Critical 9.8
    CVE-2017-8658 EPSS 20%

    ChakraCore RCE Vulnerability

    A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".

    Microsoft ChakraCore Microsoft.ChakraCore NuGet
  • Critical 9.1
    CVE-2016-5018 EPSS 10%

    Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Critical 9.8
    CVE-2015-1820

    rest-client Gem Vulnerable to Session Fixation

    REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

    rest-client ruby-rest-client Debian RubyGems
  • Critical 9.8
    CVE-2015-6941

    salt password information leaked in debug logs

    win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

    salt salt Ubuntu PyPI
  • Critical 9.8
    CVE-2012-0803

    Improper Authentication in Apache CXF

    The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request.

    org.apache.cxf:cxf Maven
  • Critical 9.8
    CVE-2017-9855

    An issue was discovered in SMA Solar Technology products. A secondary authentication system is available for Installers…