Vulnerabilities > Rapid7 > Nexpose > 6.4.38

DATE CVE VULNERABILITY TITLE RISK
2017-12-14 CVE-2017-5264 Cross-Site Request Forgery (CSRF) vulnerability in Rapid7 Nexpose
Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.
network
low complexity
rapid7 CWE-352
8.8
8.8
2017-06-06 CVE-2017-5243 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Rapid7 Nexpose
The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions.
network
high complexity
rapid7 CWE-327
8.5
8.5