Archive
November 2017
Vulnerabilities first published in this month (UTC), newest first.
1,068 results · Feed
-
Unscored —
The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipc…
-
High 8.8
Deserialization of Untrusted Data in swagger-codegen
A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'g…
-
Unscored —
Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.
-
Unscored —
GitPHP by xiphux is vulnerable to OS Command Injections
-
Unscored —
An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts p…
-
Critical 9.8
Arbitrary Code Execution in mathjs
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
-
High —
Arbitrary JavaScript Execution in typed-function
typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
-
Critical 9.8
Arbitrary Code Execution in mathjs
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
-
Unscored —
The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users…
-
Unscored —
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shel…
-
Unscored —
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shel…
-
Unscored —
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shel…
-
Unscored —
A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated at…
-
Unscored —CVE-2017-16962 Public exploit
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities v…
-
Unscored —
SQL injection vulnerability in the InLinks plugin through 1.1 for WordPress allows authenticated users to execute arbit…
-
Unscored —
b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a seco…
-
High 8.1
Deserialization of Untrusted Data in Spring Security
An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jack…
-
Critical 9.8
Deserialization of Untrusted Data in Spring AMQP
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code executio…
-
Unscored —
In Cloud Foundry Foundation Credhub-release version 1.1.0, access control lists (ACLs) enforce whether an authenticated…
-
Medium 5.9
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expression…
-
High 8.1
Improper Authentication in Pivotal Spring-LDAP
In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the aut…
-
Unscored —
In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allo…
-
Medium 5.3
Cloud Foundry UAA Denial of Service through client token revocation endpoint
An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular c…
-
High 8.8
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-20…
-
Unscored —
In Cloud Foundry Foundation cf-deployment v0.35.0, a misconfiguration with Loggregator and syslog-drain causes logs to …
-
Unscored —
TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possi…
-
Unscored —
The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, whic…
-
Unscored —
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbit…
-
Unscored —
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denia…
-
Unscored —
In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w…
-
Unscored —
October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to exe…
-
Unscored —CVE-2017-16939 Public exploit
The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to ga…
-
Unscored —
The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin pa…
-
Unscored —CVE-2017-16935 Public exploit
Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers t…
-
Unscored —
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecif…
-
Unscored —
Directory Traversal vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac…
-
Unscored —
auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended ac…
-
Unscored —
etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, w…
-
High 7.5
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
-
Unscored —
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHand…