Skip to content
OpenAdvisories

Archive

27 November 2017

Vulnerabilities first published on this day (UTC), newest first.

← October 2017 2017 / November /27 December 2017 →
  1. 133
  2. 223
  3. 333
  4. 417
  5. 54
  6. 629
  7. 744
  8. 821
  9. 933
  10. 1013
  11. 111
  12. 126
  13. 1397
  14. 1422
  15. 1591
  16. 16124
  17. 17100
  18. 184
  19. 191
  20. 2026
  21. 2119
  22. 22162
  23. 237
  24. 247
  25. 255
  26. 261
  27. 2755
  28. 2816
  29. 2916
  30. 3058
All Critical High Medium Low Exploited only Public exploit

55 results · Feed

  • Unscored —
    CVE-2017-16958

    TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shel…

  • Unscored —
    CVE-2017-16960

    TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shel…

  • Unscored —
    CVE-2017-16961

    A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated at…

  • Unscored —
    CVE-2017-16962 Public exploit

    The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities v…

  • Unscored —
    CVE-2017-16955

    SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbit…

  • Unscored —
    CVE-2017-16956

    b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a seco…

  • High 8.1
    CVE-2017-4995

    Deserialization of Untrusted Data in Spring Security

    An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jack…

    org.springframework.security:spring-security-core Maven
  • Critical 9.8
    CVE-2017-8045

    Deserialization of Untrusted Data in Spring AMQP

    In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code executio…

    org.springframework.amqp:spring-amqp Maven
  • Unscored —
    CVE-2017-8038

    In Cloud Foundry Foundation Credhub-release version 1.1.0, access control lists (ACLs) enforce whether an authenticated…

  • Medium 5.9
    CVE-2017-8039

    Insecure Default Initialization of Resource in Pivotal Spring Web Flow

    An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expression…

    org.springframework.webflow:spring-webflow Maven
  • High 8.1
    CVE-2017-8028

    Improper Authentication in Pivotal Spring-LDAP

    In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the aut…

    org.springframework.ldap:spring-ldap-core libspring-ldap-java Ubuntu Maven
  • Unscored —
    CVE-2017-8044

    In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allo…

  • Medium 5.3
    CVE-2017-8031

    Cloud Foundry UAA Denial of Service through client token revocation endpoint

    An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular c…

    org.cloudfoundry.identity:cloudfoundry-identity-server Maven
  • High 8.8
    CVE-2017-14176

    Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname

    Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-20…

    bzr breezy bzr bzr Debian Ubuntu PyPI
  • Unscored —
    CVE-2017-14390

    In Cloud Foundry Foundation cf-deployment v0.35.0, a misconfiguration with Loggregator and syslog-drain causes logs to …