Skip to content
OpenAdvisories

Archive

2 January 2018

Vulnerabilities first published on this day (UTC), newest first.

← December 2017 2018 / January /2 February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.1
    CVE-2017-1000427

    Marked vulnerable to XSS from data URIs

    marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.

    marked node-marked node-marked Debian Ubuntu npm
  • Medium 6.1
    CVE-2017-1000425

    Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page

    Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter.

    com.liferay.portal:release.portal.bom Maven
  • Medium 6.1
    CVE-2017-1000426

    MapProxy vulnerable to cross-site scripting in demo service

    MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information disclosure.

    mapproxy mapproxy Debian PyPI
  • Medium 4.3
    CVE-2017-1000424

    Electron vulnerable to URL spoofing via PDFium

    Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

    electron npm
  • Medium 6.1
    CVE-2017-1000431

    eZ Publish Cross-site Scripting (XSS) vulnerability

    eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.

    ezsystems/ezpublish-legacy Packagist
  • Medium 5.4
    CVE-2017-1000442

    Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar

    Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace

    passbolt/passbolt_api Packagist