Skip to content
OpenAdvisories

Archive

2 October 2017

Vulnerabilities first published on this day (UTC), newest first.

← September 2017 2017 / October /2 November 2017 →
  1. 110
  2. 264
  3. 343
  4. 456
  5. 543
  6. 635
  7. 7 
  8. 8 
  9. 913
  10. 1084
  11. 1155
  12. 1223
  13. 1398
  14. 143
  15. 156
  16. 1643
  17. 1741
  18. 1854
  19. 19229
  20. 2019
  21. 2112
  22. 2260
  23. 23118
  24. 2434
  25. 257
  26. 2631
  27. 27102
  28. 288
  29. 2930
  30. 3031
  31. 3146
All Critical High Medium Low Exploited only Public exploit

64 results · Feed

  • Unscored —
    CVE-2017-14757 Public exploit

    OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might …

  • Unscored —
    CVE-2017-14979

    Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to…

  • Unscored —
    CVE-2017-14759

    OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might …

  • Unscored —
    CVE-2017-14990

    WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_ke…

    wordpress wordpress Debian Ubuntu
  • Unscored —
    CVE-2017-14755

    OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might …

  • Unscored —
    CVE-2017-14754

    OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might …

  • Unscored —
    CVE-2017-14756

    OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might …

  • Unscored —
    CVE-2017-14758 Public exploit

    OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might …

  • Unscored —
    CVE-2017-12792 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authent…

  • Critical 9.8
    CVE-2017-12620

    Improper Restriction of XML External Entity Reference in Apache OpenNLP

    When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 …

    Apache Software Foundation Apache OpenNLP org.apache.opennlp:opennlp-tools Maven
  • Unscored —
    CVE-2017-9537

    Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.1…

  • Unscored —
    CVE-2017-9538

    The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows re…

  • Medium 5.3
    CVE-2014-0043 Public exploit

    Apache Wicket allows attackers to check for third-party libraries

    In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in u…

    Apache Software Foundation Apache Wicket org.apache.wicket:wicket-core Maven
  • High 8.8
    CVE-2016-6806

    Apache Wicket vulnerable to CSRF attacks

    Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account…

    Apache Software Foundation Apache Wicket org.apache.wicket:wicket-core Maven
  • Medium 6.5
    CVE-2017-9797

    Apache Geode vulnerable to Exposure of Sensitive Information

    When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, …

    Apache Software Foundation Apache Geode org.apache.geode:geode-core Maven
  • Unscored —
    CVE-2017-13997

    A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 …

  • Unscored —
    CVE-2017-8021

    EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially …

  • Unscored —
    CVE-2017-8018

    EMC AppSync host plug-in versions 3.5 and below (Windows platform only) includes a denial of service (DoS) vulnerabilit…

    Windows
  • Unscored —
    CVE-2017-14985

    Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authentica…

  • Unscored —
    CVE-2017-14988

    Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessi…

    openexr OpenEXR Debian Azure Linux
  • Unscored —
    CVE-2017-14983

    Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authentica…

  • Unscored —
    CVE-2017-14984

    Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authentica…

  • Unscored —
    CVE-2017-14989

    A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the ap…

    imagemagick imagemagick Debian Ubuntu
  • Unscored —
    CVE-2017-14981

    Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtrati…