Skip to content
OpenAdvisories

Archive

27 November 2017

Vulnerabilities first published on this day (UTC), newest first.

← October 2017 2017 / November /27 December 2017 →
  1. 133
  2. 223
  3. 333
  4. 417
  5. 54
  6. 629
  7. 744
  8. 821
  9. 933
  10. 1013
  11. 111
  12. 126
  13. 1397
  14. 1422
  15. 1591
  16. 16124
  17. 17100
  18. 184
  19. 191
  20. 2026
  21. 2119
  22. 22162
  23. 237
  24. 247
  25. 255
  26. 261
  27. 2755
  28. 2816
  29. 2916
  30. 3058
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.4
    CVE-2017-15051

    TeamPass stored cross-site scripting (XSS) vulnerability

    Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the atta…

    nilsteampassnet/teampass Packagist
  • Medium 4.9
    CVE-2017-15052

    TeamPass Improper Privilege Management

    TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user (including admin), or modify attributes of any arbitrary user except administrator.…

    nilsteampassnet/teampass Packagist
  • Medium 4.9
    CVE-2017-15053

    TeamPass Improper Privilege Management

    TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerabilit…

    nilsteampassnet/teampass Packagist
  • Medium 5.9
    CVE-2017-8039

    Insecure Default Initialization of Resource in Pivotal Spring Web Flow

    An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expression…

    org.springframework.webflow:spring-webflow Maven
  • Medium 5.3
    CVE-2017-8031

    Cloud Foundry UAA Denial of Service through client token revocation endpoint

    An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular c…

    org.cloudfoundry.identity:cloudfoundry-identity-server Maven