Skip to content
OpenAdvisories

Archive

9 February 2018

Vulnerabilities first published on this day (UTC), newest first.

← January 2018 2018 / February /9 March 2018 →
  1. 128
  2. 266
  3. 39
  4. 46
  5. 540
  6. 664
  7. 761
  8. 874
  9. 977
  10. 10 
  11. 113
  12. 1254
  13. 1329
  14. 1438
  15. 15340
  16. 1622
  17. 1731
  18. 1811
  19. 1943
  20. 2028
  21. 2147
  22. 2248
  23. 2359
  24. 2411
  25. 256
  26. 2630
  27. 2777
  28. 2828
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 4.3
    CVE-2018-1000057

    Jenkins Credentials Binding Plugin has Insufficiently Protected Credentials

    Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different…

    org.jenkins-ci.plugins:credentials-binding Maven
  • Medium 5.3
    CVE-2018-1000023

    Insight API transaction broadcast endpoint can result in Full Path Disclosure

    Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.

    insight-api npm
  • Medium 5.4
    CVE-2017-1000509

    Dolibarr ERP and CRM contain XSS Vulnerability

    Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2017-1000506

    Mautic Cross Site Scripting (XSS) vulnerability

    Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.

    mautic/core Packagist
  • Medium 5.4
    CVE-2017-1000510

    Cross site scripting in Croogo

    Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.

    croogo/croogo Packagist
  • Medium 5.4
    CVE-2017-1000507

    Canvs Canvas XSS Vulnerability

    Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code.

    austintoddj/canvas Packagist
  • Medium 5.5
    CVE-2017-10689

    Tarball permission preservation in puppet

    In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.

    Puppet Puppet Enterprise Puppet Agent puppet Debian Ubuntu RubyGems
  • Medium 5.9
    CVE-2018-1298

    Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j

    A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated atta…

    Apache Software Foundation Apache Qpid Broker-J org.apache.qpid:apache-qpid-broker-j Maven