Skip to content
OpenAdvisories

Archive

12 October 2017

Vulnerabilities first published on this day (UTC), newest first.

← September 2017 2017 / October /12 November 2017 →
  1. 110
  2. 264
  3. 343
  4. 456
  5. 543
  6. 635
  7. 7 
  8. 8 
  9. 913
  10. 1084
  11. 1155
  12. 1223
  13. 1398
  14. 143
  15. 156
  16. 1643
  17. 1741
  18. 1854
  19. 19229
  20. 2019
  21. 2112
  22. 2260
  23. 23118
  24. 2434
  25. 257
  26. 2631
  27. 27102
  28. 288
  29. 2930
  30. 3031
  31. 3146
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2017-12849

    Silverstripe CMS User Enumeration

    Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

    silverstripe/cms Packagist
  • Medium 5.3
    CVE-2017-10862

    Insufficient Data Verification in io.really:jwt-scala

    jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token.

    reallyl IO jwt-scala io.really:jwt-scala Maven
  • Medium 5.5
    CVE-2017-15280

    Umbraco CMS XXE Vulnerability

    XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialo…

    UmbracoCms.Web NuGet
  • Medium 5.4
    CVE-2017-15284 Public exploit

    OctoberCMS Cross-Site Scripting

    Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context …

    october/rain Packagist
  • Medium 5.4
    CVE-2017-15278

    TeamPass Cross-Site Scripting (XSS)

    Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.queries.php). An attacker could execute arbitrary HTML and script code in a browser in the context of t…

    nilsteampassnet/teampass Packagist
  • Medium 5.4
    CVE-2017-15279

    Umbraco CMS vulnerable to stored XSS

    Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publi…

    UmbracoCms.Web NuGet