Skip to content
OpenAdvisories

Archive

27 November 2017

Vulnerabilities first published on this day (UTC), newest first.

← October 2017 2017 / November /27 December 2017 →
  1. 133
  2. 223
  3. 333
  4. 417
  5. 54
  6. 629
  7. 744
  8. 821
  9. 933
  10. 1013
  11. 111
  12. 126
  13. 1397
  14. 1422
  15. 1591
  16. 16124
  17. 17100
  18. 184
  19. 191
  20. 2026
  21. 2119
  22. 22162
  23. 237
  24. 247
  25. 255
  26. 261
  27. 2755
  28. 2816
  29. 2916
  30. 3058
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2017-15055

    TeamPass Improper Privilege Management

    TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitra…

    nilsteampassnet/teampass Packagist
  • High 7.5
    CVE-2017-15054

    TeamPass arbitrary file upload vulnerability

    An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameter…

    nilsteampassnet/teampass Packagist
  • High 8.8
    CVE-2017-1000207

    Deserialization of Untrusted Data in swagger-codegen

    A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'g…

    io.swagger:swagger-codegen io.swagger:swagger-parser Maven
  • High —
    CVE-2017-1001004

    Arbitrary JavaScript Execution in typed-function

    typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.

    typed-function typed-function typed-function npm
  • High 8.1
    CVE-2017-4995

    Deserialization of Untrusted Data in Spring Security

    An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jack…

    org.springframework.security:spring-security-core Maven
  • High 8.1
    CVE-2017-8028

    Improper Authentication in Pivotal Spring-LDAP

    In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the aut…

    org.springframework.ldap:spring-ldap-core libspring-ldap-java Ubuntu Maven
  • High 8.8
    CVE-2017-14176

    Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname

    Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-20…

    bzr breezy bzr bzr Debian Ubuntu PyPI