Archive
10 November 2017
Vulnerabilities first published on this day (UTC), newest first.
13 results · Feed
-
Unscored —
-
Unscored —
In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter.
-
Unscored —CVE-2017-16780 Public exploit
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration f…
-
Unscored —CVE-2017-16781 Public exploit
The installer in MyBB before 1.8.13 has XSS.
-
Unscored —
In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Mark…
-
Unscored —CVE-2017-16783 Public exploit
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.
-
Unscored —
XSS exists on D-Link DWR-933 1.00(WW)B17 devices via cgi-bin/gui.cgi.
-
Unscored —
An Open Redirect vulnerability in Inedo BuildMaster before 5.8.2 allows remote attackers to redirect users to arbitrary…
-
Critical 9.8
Unsafe deserialization in confire
An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from "~/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary Python commands r…
-
High 7.5
Sanic arbitrary file read and directory traversal
Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.
-
Unscored —
Inedo BuildMaster before 5.8.2 has XSS.
-
Unscored —
In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used.
-
Critical 9.8
django_make_app is vulnerable to Code Injection
An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into …