CVE-2017-1000052

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-10000538.1Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.SessCVE-2017-10000546.1Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.CVE-2017-10000569.8Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability toCVE-2017-10000586.1Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.CVE-2017-10000596.1Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of anyCVE-2017-10000609.8EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote rootCVE-2017-10000617.1xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible informatCVE-2017-10000627.5kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code executionCVE-2017-10000636.1kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosureCVE-2017-10000647.5kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoSCVE-2017-10000656.1Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionalitCVE-2017-10000667.5The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the
CVE-2017-1000052: High severity, CVSS 7.8 | Vulnix