CVE-2017-1000192

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/nuxsmin/sysPass/releases/tag/2.1.8.17042901Release Notes, Third Party Advisory
https://github.com/nuxsmin/sysPass/releases/tag/2.1.8.17042901Release Notes, Third Party Advisory

Timeline

Published: Nov 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10001936.1October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim'CVE-2017-10001949.8October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and poss CVE-2017-10001957.5October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file CVE-2017-10001969.8October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other CVE-2017-10001979.8October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on CVE-2017-10001987.5tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of s CVE-2017-10001997.5tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able CVE-2017-100025.4Vulnerability in the Oracle Hospitality Inventory Management component of Oracle Hospitality Applications (subcomponent: Settings and Config CVE-2017-10002007.5tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a dbus triggered NULL pointer dereference in the tcmu-runner daemon's on_unregister_hand CVE-2017-10002015.5The tcmu-runner daemon in tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a local denial of service attack CVE-2017-10002038.8ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code e CVE-2017-10002069.8samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec resulting in potential arbitrary c