Skip to content
OpenAdvisories

Archive

1 March 2018

Vulnerabilities first published on this day (UTC), newest first.

← February 2018 2018 / March /1 April 2018 →
  1. 153
  2. 246
  3. 3 
  4. 412
  5. 551
  6. 658
  7. 724
  8. 859
  9. 9104
  10. 104
  11. 115
  12. 1247
  13. 1372
  14. 14144
  15. 1553
  16. 1642
  17. 173
  18. 189
  19. 1930
  20. 2061
  21. 2132
  22. 2267
  23. 2329
  24. 2413
  25. 2535
  26. 2651
  27. 2766
  28. 2856
  29. 2933
  30. 3071
  31. 319
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.5
    CVE-2017-6931

    Drupal Settings Tray access bypass

    In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the cor…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Packagist
  • Medium 6.1
    CVE-2017-6927

    Drupal cross-site scripting vulnerability

    Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoe…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2017-6929

    Drupal cross site scripting vulnerability

    A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Medium 4.7
    CVE-2017-6932

    Drupal external link injection vulnerability

    Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users int…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2017-6928

    Drupal access bypass vulnerability

    Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying t…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2017-7426

    iManager - XML External Entity vulnerabilities

    The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that could be used by attackers to leak information or cause denial of service attacks.

    NetIQ Identity Manager Plug-ins
  • Medium 4.4
    CVE-2017-9268

    open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions

    In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource c…

    SUSE open build service open-build-service open-build-service Debian Ubuntu
  • Medium 4.0
    CVE-2017-9271

    proxy credentials written to log files by zypper

    The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.

    SUSE zypper libzypp zypper Debian Ubuntu
  • Medium 5.0
    CVE-2017-5188

    OBS worker VM escape via relative symbolic links

    The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.

    openSUSE open build service open-build-service open-build-service Debian Ubuntu
  • Medium 5.4
    CVE-2017-14800

    Reflected xss on Access Manager iManager UI

    A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code injection into pages of authenticated users.

    NetIQ Access Manager
  • Medium 4.6
    CVE-2017-14799

    XSS Vulnerability with ESP URL

    A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page.

    NetIQ Access Manager
  • Medium 6.6
    CVE-2018-2380 Exploited · Ransomware Public exploit EPSS 29%

    SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information p…

    SAP SAP CRM
    KEV Nov 3, 2021