Archive
20 September 2017
Vulnerabilities first published on this day (UTC), newest first.
4 results · Clear filters · Feed
-
High 8.1
Access Restriction Bypass in go-ldap
In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function c…
-
High 7.5
Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing vali…
-
High 7.5
The REST Plugin in Apache Struts is using an outdated XStream library
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
-
High 8.8
IPython vulnerable to cross site request forgery (CSRF)
Cross-site request forgery in the REST API in IPython 2 and 3.