Skip to content
OpenAdvisories

Archive

26 October 2017

Vulnerabilities first published on this day (UTC), newest first.

← September 2017 2017 / October /26 November 2017 →
  1. 110
  2. 264
  3. 343
  4. 456
  5. 543
  6. 635
  7. 7 
  8. 8 
  9. 913
  10. 1084
  11. 1155
  12. 1223
  13. 1398
  14. 143
  15. 156
  16. 1643
  17. 1741
  18. 1854
  19. 19229
  20. 2019
  21. 2112
  22. 2260
  23. 23118
  24. 2434
  25. 257
  26. 2631
  27. 27102
  28. 288
  29. 2930
  30. 3031
  31. 3146
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2017-12158

    Keycloak Reflected XSS

    It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

    Red Hat keycloak org.keycloak:keycloak-parent Maven
  • Medium 4.8
    CVE-2017-15911

    Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console

    The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the po…

    org.igniterealtime.openfire:parent Maven
  • Medium 5.3
    CVE-2017-15906

    The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly…

    openssh openssh openssh Debian Ubuntu Alpine