Skip to content
OpenAdvisories

Archive

3 January 2018

Vulnerabilities first published on this day (UTC), newest first.

← December 2017 2018 / January /3 February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2017-1000484

    Plone Open Redirect

    By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, y…

    plone PyPI
  • Medium 6.1
    CVE-2017-1000481

    Products.CMFPlone Open Redirect Vulnerability

    When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by …

    plone products-cmfplone PyPI
  • Medium 6.5
    CVE-2017-1000483

    Plone Unauthorized Access Vulnerability

    Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5.

    plone PyPI
  • Medium 5.4
    CVE-2017-1000482

    Products.CMFPlone XSS in profile home_page property

    A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.

    plone products-cmfplone PyPI
  • Medium 6.5
    CVE-2017-1000490

    Mautic users able to download any files from server using filemanager

    Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

    mautic/core Packagist
  • Medium 6.1
    CVE-2017-1000488

    Inline JS XSS vulnerability in Mautic

    Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.

    mautic/core Packagist
  • Medium 5.4
    CVE-2017-1000467

    Stored XSS in LavaLite 5.2.4

    LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2017-1000495

    QuickApps CMS Cross-site Scripting

    QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account

    quickapps/cms Packagist
  • Medium 6.1
    CVE-2017-1000491

    Shiba vulnerable to XSS leading to code execution

    Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.

    shiba npm