漏洞公告

Remote code execution in verot/class.upload.php

SQL injection in phpMyAdmin

Persistent XSS vulnerability in filename of attached file in PrivateBin

Stored XSS in Apache Atlas

XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes

The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841

PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841

PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841

HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)

cookie-signature Timing Attack

Deserialization of Untrusted Data in Log4j

Deserialization of Untrusted Data in Log4j

Remote Code Execution Vulnerability in NPM mongo-express

Insufficiently Protected Credentials in Apache Tomcat

In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack

Prototype Pollution in handlebars

HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress

HTTP Request Smuggling: Content-Length Sent Twice in Waitress

HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

HTTP Request Smuggling: LF vs CRLF handling in Waitress

Possible Information Leak / Session Hijack Vulnerability in Rack

Insert tag injection in the Contao login module