Skip to content
OpenAdvisories

Archive

3 January 2018

Vulnerabilities first published on this day (UTC), newest first.

← December 2017 2018 / January /3 February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

57 results · Feed

  • Medium 5.4
    CVE-2017-1000467

    Stored XSS in LavaLite 5.2.4

    LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.

    lavalite/cms Packagist
  • Unscored —
    CVE-2017-1000501

    Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" pa…

    awstats awstats awstats Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-1000497

    Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service an…

  • High 7.8
    CVE-2017-1000498

    Android SVG vulnerable to XML External Entity (XXE)

    AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution

    com.caverock:androidsvg Maven
  • Unscored —
    CVE-2017-1000494

    Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an att…

    miniupnpd miniupnpd miniupnpc miniupnpc Debian Ubuntu
  • High 8.8
    CVE-2017-1000499 Public exploit

    phpMyAdmin CSRF Vulnerability

    phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.

    phpmyadmin/phpmyadmin Packagist
  • Unscored —
    CVE-2017-1000496

    Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of serv…

  • Medium 5.4
    CVE-2017-1000495

    QuickApps CMS Cross-site Scripting

    QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account

    quickapps/cms Packagist
  • Unscored —
    CVE-2018-4868

    The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of s…

  • Unscored —
    CVE-2018-4862

    In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could ref…

  • Unscored —
    CVE-2017-18017 EPSS 53%

    The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36…

    linux-raspi2 linux-hwe linux-riscv linux-gcp Debian Ubuntu
  • Medium 6.1
    CVE-2017-1000491

    Shiba vulnerable to XSS leading to code execution

    Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.

    shiba npm
  • Unscored —
    CVE-2017-1000493

    Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover

  • Unscored —
    CVE-2017-1000466

    Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation pag…

  • Unscored —
    CVE-2017-1000492

    Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration

  • Unscored —
    CVE-2017-1000459

    Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes

  • Unscored —
    CVE-2017-1000463

    Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page,…