Archive
October 2017
Vulnerabilities first published in this month (UTC), newest first.
52 results · Clear filters · Feed
-
Medium 5.4
Keycloak Reflected XSS
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
-
Medium 4.8
Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the po…
-
Medium 5.3
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly…
-
Medium 4.8
Cross-Site Scripting in keystone
Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than CVE-2017-15878.
-
Medium 6.1CVE-2017-15878 Public exploit
Cross-Site Scripting in keystone
A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.
-
Medium 5.5
The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that …
-
Medium 5.0
archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violatio…
-
Medium 6.1
Pallets Werkzeug cross-site scripting vulnerability
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a fiel…
-
Medium 5.3CVE-2017-9947 Public exploit
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V…
-
Medium 5.4
TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms
Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to…
-
Medium 5.4
Cross-site Scripting in Apache NiFi
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
-
Medium 6.1
Cross-site Scripting in Mistune
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.
-
Medium 5.3
Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over …
-
Medium 6.1CVE-2017-15374 Public exploit
Shopware XSS Vulnerability
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to p…
-
Medium 5.5
ccsv Double Free vulnerability
The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file. NOTE: This has been disputed and it is argued that this is …
-
Medium 5.3
Junos OS: Denial of service vulnerability in telnetd
A denial of service vulnerability in telnetd service on Juniper Networks Junos OS allows remote unauthenticated attackers to cause a denial of service. Affected Junos OS releases are: 12.1X46 prior to 12.1X46-D71; 12.3X48 prior to 12.3X48-D50; 14.1 prior to 1…
-
Medium 5.3
Contrail: hard coded credentials
The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-201…
-
Medium 4.4
SRX Series: Cryptographic weakness in SRX300 Series TPM Firmware
Version 4.40 of the TPM (Trusted Platform Module) firmware on Juniper Networks SRX300 Series has a weakness in generating cryptographic keys that may allow an attacker to decrypt sensitive information in SRX300 Series products. The TPM is used in the SRX300 S…
-
Medium 5.3
Junos OS: A remote unauthenticated attacker can consume large amounts of CPU and/or memory through telnetd
A vulnerability in telnetd service on Junos OS allows a remote attacker to cause a limited memory and/or CPU consumption denial of service attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 1…
-
Medium 5.9
Junos: RPD core due to BGP UPDATE with malformed optional transitive attributes
When the 'bgp-error-tolerance' feature â€" designed to help mitigate remote session resets from malformed path attributes â€" is enabled, a BGP UPDATE containing a specifically crafted set of transitive attributes can cause the RPD routing…
-
Medium 5.5
Junos OS: A kernel hang may occur due to a specific loopback filter action command
A vulnerability in a specific loopback filter action command, processed in a specific logical order of operation, in a running configuration of Juniper Networks Junos OS, allows an attacker with CLI access and the ability to initiate remote sessions to the lo…
-
Medium 5.0CVE-2017-10617 Public exploit
Contrail: XML External Entity (XXE) vulnerability
The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 pri…
-
Medium 6.5
Junos: EX Series PFE and MX MPC7E/8E/9E PFE crash when fetching interface stats with 'extended-statistics' enabled
If extended statistics are enabled via 'set chassis extended-statistics', when executing any operation that fetches interface statistics, including but not limited to SNMP GET requests, the pfem process or the FPC may crash and restart. Repeated crashes of PF…
-
Medium 6.5
Moderate severity vulnerability that affects org.apache.ranger:ranger
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.
-
Medium 5.3
Silverstripe CMS User Enumeration
Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.
-
Medium 5.3
Insufficient Data Verification in io.really:jwt-scala
jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token.
-
Medium 5.5
Umbraco CMS XXE Vulnerability
XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialo…
-
Medium 5.4CVE-2017-15284 Public exploit
OctoberCMS Cross-Site Scripting
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context …
-
Medium 5.4
TeamPass Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.queries.php). An attacker could execute arbitrary HTML and script code in a browser in the context of t…
-
Medium 5.4
Umbraco CMS vulnerable to stored XSS
Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publi…
-
Medium 6.5
XML External Entity Reference in Apache NiFi
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prio…
-
Medium 6.3
salt leaks git usernames and passwords to the log
salt before 2015.5.5 leaks git usernames and passwords to the log.
-
Medium 5.9
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
-
Medium 6.5
Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to conn…
-
Medium 6.5
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those number…
-
Medium 4.3
Improper Authentication in Jenkins Blue Ocean Plugin
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's aut…
-
Medium 5.3
Jenkins Build Step Plugin fails to check Item/Build permission
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggerin…
-
Medium 4.3
Jenkins GitHub Branch Source Plugin allows any user with Overall/Read permission to get list of valid credentials IDs
GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid creden…
-
Medium 6.5
Improper Privilege Management in Jenkins Config File Provider Plugin
The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read access to Jenkins were able to access URLs directly that allowed viewing these files. Access to view th…
-
Medium 5.4
Persistent XSS vulnerability in Static Analysis Utilities
The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build w…