Skip to content
OpenAdvisories

Archive

October 2017

Vulnerabilities first published in this month (UTC), newest first.

← September 2017 2017 / October November 2017 →
  1. 110
  2. 264
  3. 343
  4. 456
  5. 543
  6. 635
  7. 7 
  8. 8 
  9. 913
  10. 1084
  11. 1155
  12. 1223
  13. 1398
  14. 143
  15. 156
  16. 1643
  17. 1741
  18. 1854
  19. 19229
  20. 2019
  21. 2112
  22. 2260
  23. 23118
  24. 2434
  25. 257
  26. 2631
  27. 27102
  28. 288
  29. 2930
  30. 3031
  31. 3146
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.1
    CVE-2017-15878 Public exploit

    Cross-Site Scripting in keystone

    A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.

    keystone npm
  • Medium 5.3
    CVE-2017-9947 Public exploit

    A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V…

  • Medium 6.1
    CVE-2017-15374 Public exploit

    Shopware XSS Vulnerability

    Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to p…

    shopware/shopware Packagist
  • Medium 5.0
    CVE-2017-10617 Public exploit

    Contrail: XML External Entity (XXE) vulnerability

    The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 pri…

    Juniper Networks Contrail Network devices
  • Medium 5.4
    CVE-2017-15284 Public exploit

    OctoberCMS Cross-Site Scripting

    Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context …

    october/rain Packagist
  • Medium 5.3
    CVE-2014-0043 Public exploit

    Apache Wicket allows attackers to check for third-party libraries

    In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in u…

    Apache Software Foundation Apache Wicket org.apache.wicket:wicket-core Maven