Skip to content
OpenAdvisories

Archive

17 November 2017

Vulnerabilities first published on this day (UTC), newest first.

← October 2017 2017 / November /17 December 2017 →
  1. 133
  2. 223
  3. 333
  4. 417
  5. 54
  6. 629
  7. 744
  8. 821
  9. 933
  10. 1013
  11. 111
  12. 126
  13. 1397
  14. 1422
  15. 1591
  16. 16124
  17. 17100
  18. 184
  19. 191
  20. 2026
  21. 2119
  22. 22162
  23. 237
  24. 247
  25. 255
  26. 261
  27. 2755
  28. 2816
  29. 2916
  30. 3058
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.5
    CVE-2017-1000221

    Opencast has Incorrect Permission Assignment

    In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restrict…

    org.opencastproject:opencast-kernel Maven
  • Medium 6.1
    CVE-2017-16880

    filp whoops Cross-site Scripting vulnerability

    The dump function in Util/TemplateHelper.php in filp whoops before 2.1.13 has XSS.

    filp/whoops Packagist
  • Medium 6.1
    CVE-2017-1000163 Scanner template

    Phoenix Arbitrary URL Redirect

    The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.

    phoenix Hex
  • Medium 6.5
    CVE-2017-1000168

    scalarmult() vulnerable to degenerate public keys

    sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys

    sodiumoxide crates.io
  • Medium 5.3
    CVE-2017-1000246

    Pysaml2 improperly initializes encryption vector

    Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.

    pysaml2 python-pysaml2 python-pysaml2 Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2017-1000188

    mde ejs vulnerable to XSS

    nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

    node-ejs ejs Debian npm
  • Medium 5.9
    CVE-2017-1000209

    nv-websocket-client allows attackers to spoof SSL/TLS servers via an arbitrary valid certificate

    The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers …

    com.neovisionaries:nv-websocket-client Maven
  • Medium 6.1
    CVE-2017-1000193

    October CMS XSS

    October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.

    october/october Packagist