Symphony
Symphony Project · 2 CVEs
CVE-2017-16956
MEDIUM
b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a seco…
Nov 27, 2017
CVE-2017-16881
MEDIUM
b3log Symphony (aka Sym) 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarUR…
Nov 18, 2017
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2017-16956 | b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title. | MEDIUM | 0.74% | Nov 27, 2017 |
| CVE-2017-16881 | b3log Symphony (aka Sym) 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarURL value to /settings/avatar, related to… | MEDIUM | 0.82% | Nov 18, 2017 |
Showing 1 to 2 of 2 CVEs