Archive
2 January 2018
Vulnerabilities first published on this day (UTC), newest first.
6 results · Clear filters · Feed
-
High 8.1
pysaml2 Improper Authentication vulnerability
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.
-
High 7.5
phpBB Server-Side Request Forgery (SSRF)
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.
-
High 7.5
Syncthing vulnerable to symlink traversal and arbitrary file overwrite
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
-
High 8.8
Integer Overflow or Wraparound in OpenCV.
In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 a…
-
High 7.8
fs-git command injection vulnerability
fs-git is a file system like api for git repository. The fs-git version 1.0.1 module relies on child_process.exec, however, the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across al…
-
High 7.5
Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.