17 November 2017

7 results · Clear filters · Feed

• Critical 9.1
  CVE-2017-1000190

  SimpleXML has XML External Entity (XXE) vulnerability

  SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.

  org.simpleframework:simple-xml simple-xml simple-xml Debian Ubuntu Maven
  Nov 17, 2017
• Critical 9.8
  CVE-2017-1000212

  alchemist.vim vulnerable to remote code execution

  Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.

  alchemist.vim Hex
  Nov 17, 2017
• Critical 9.8
  CVE-2017-1000248

  redis-store deserializes untrusted data

  Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis

  ruby-redis-store ruby-redis-store redis-store Debian Ubuntu RubyGems
  Nov 17, 2017
• Critical 9.8
  CVE-2017-1000228

  ejs is vulnerable to remote code execution due to weak input validation

  nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

  node-ejs ejs Debian npm
  Nov 17, 2017
• Critical 9.8
  CVE-2017-1000194

  October CMS File Upload Vulnerability

  October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.

  october/october Packagist
  Nov 17, 2017
• Critical 9.8
  CVE-2017-1000220

  PIDUsage Enables OS Command Injection

  soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution

  pidusage npm
  Nov 17, 2017
• Critical 9.8
  CVE-2017-1000219

  Command Execution in windows-cpu

  npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user

  windows-cpu npm
  Nov 17, 2017