Skip to content
OpenAdvisories

Archive

January 2018

Vulnerabilities first published in this month (UTC), newest first.

← December 2017 2018 / January February 2018 →
  1. 111
  2. 240
  3. 357
  4. 466
  5. 527
  6. 64
  7. 71
  8. 859
  9. 933
  10. 10105
  11. 1149
  12. 12118
  13. 1326
  14. 1420
  15. 154
  16. 1645
  17. 176
  18. 18217
  19. 1932
  20. 205
  21. 217
  22. 2227
  23. 2364
  24. 2452
  25. 2539
  26. 2655
  27. 277
  28. 281
  29. 2936
  30. 3023
  31. 3139
All Critical High Medium Low Exploited only Public exploit

90 results · Clear filters · Feed

  • Medium 6.1
    CVE-2017-1000488

    Inline JS XSS vulnerability in Mautic

    Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.

    mautic/core Packagist
  • Medium 5.4
    CVE-2017-1000467

    Stored XSS in LavaLite 5.2.4

    LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2017-1000495

    QuickApps CMS Cross-site Scripting

    QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account

    quickapps/cms Packagist
  • Medium 6.1
    CVE-2017-1000491

    Shiba vulnerable to XSS leading to code execution

    Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.

    shiba npm
  • Medium 6.1
    CVE-2017-1000427

    Marked vulnerable to XSS from data URIs

    marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.

    marked node-marked node-marked Debian Ubuntu npm
  • Medium 6.1
    CVE-2017-1000425

    Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page

    Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter.

    com.liferay.portal:release.portal.bom Maven
  • Medium 6.1
    CVE-2017-1000426

    MapProxy vulnerable to cross-site scripting in demo service

    MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information disclosure.

    mapproxy mapproxy Debian PyPI
  • Medium 4.3
    CVE-2017-1000424

    Electron vulnerable to URL spoofing via PDFium

    Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

    electron npm
  • Medium 6.1
    CVE-2017-1000431

    eZ Publish Cross-site Scripting (XSS) vulnerability

    eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.

    ezsystems/ezpublish-legacy Packagist
  • Medium 5.4
    CVE-2017-1000442

    Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar

    Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace

    passbolt/passbolt_api Packagist