plug project records

3 published records for vendor plug project.

Researcher profile

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

3 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
33Monitor	CVE-2017-1000053No exploit	Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Sessplug project · plug · CWE-502 pre-auth RCE Deserialization	High8.1	—	1.9%	Jul 17, 2017
31Monitor	CVE-2017-1000052No exploit	Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow userplug project · plug · CWE-74	High7.8	—	0.4%	Jul 17, 2017
26Monitor	CVE-2018-1000883No exploit	Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can beplug project · plug · CWE-20 Pre-auth	Medium6.5	—	1.1%	Dec 20, 2018

CVE-2017-1000053
33Monitor
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Sess
HighCVSS 8.1No exploitEPSS 2%
- pre-auth RCE
- Deserialization
plug project · plugJul 17, 2017
CVE-2017-1000052
31Monitor
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow user
HighCVSS 7.8No exploitEPSS 0%
plug project · plugJul 17, 2017
CVE-2018-1000883
26Monitor
Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
plug project · plugDec 20, 2018