# CVEs published 2017-03-03

50 CVEs were published on March 3, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-10070](https://cve.now/CVE-2016-10070.md): Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a… (no CVSS)
- [CVE-2016-3127](https://cve.now/CVE-2016-3127.md): An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62… (no CVSS, BlackBerry Good Control Server versions earlier than)
- [CVE-2016-8236](https://cve.now/CVE-2016-8236.md): Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM… (no CVSS, Lenovo Group ThinkServer RD350, RD450, RD550, RD650, TD350)
- [CVE-2016-10061](https://cve.now/CVE-2016-10061.md): The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which… (no CVSS)
- [CVE-2016-10065](https://cve.now/CVE-2016-10065.md): The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-10066](https://cve.now/CVE-2016-10066.md): Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2015-8813](https://cve.now/CVE-2015-8813.md): The Page\_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote… (no CVSS, Umbraco.CMS)
- [CVE-2015-8814](https://cve.now/CVE-2015-8814.md): Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF)… (no CVSS, Umbraco.CMS)
- [CVE-2015-8815](https://cve.now/CVE-2015-8815.md): Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML… (no CVSS)
- [CVE-2016-6882](https://cve.now/CVE-2016-6882.md): MatrixSSL before 3.8.7, when the DHE\_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key… (no CVSS)
- [CVE-2016-6883](https://cve.now/CVE-2016-6883.md): MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher… (no CVSS)
- [CVE-2016-6884](https://cve.now/CVE-2016-6884.md): TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-7406](https://cve.now/CVE-2016-7406.md): Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers… (no CVSS)
- [CVE-2016-7407](https://cve.now/CVE-2016-7407.md): The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file. (no CVSS)
- [CVE-2016-7408](https://cve.now/CVE-2016-7408.md): The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument. (no CVSS)
- [CVE-2016-7409](https://cve.now/CVE-2016-7409.md): The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG\_TRACE, allows local users to read process memory via the… (no CVSS)
- [CVE-2016-7969](https://cve.now/CVE-2016-7969.md): The wrap\_lines\_smart function in ass\_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds… (no CVSS)
- [CVE-2016-7970](https://cve.now/CVE-2016-7970.md): Buffer overflow in the calc\_coeff function in libass/ass\_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2016-7972](https://cve.now/CVE-2016-7972.md): The check\_allocations function in libass/ass\_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory… (no CVSS)
- [CVE-2016-10127](https://cve.now/CVE-2016-10127.md): PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response. (no CVSS, pysaml2)
- [CVE-2016-10193](https://cve.now/CVE-2016-10193.md): The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to… (no CVSS, espeak-ruby)
- [CVE-2016-10194](https://cve.now/CVE-2016-10194.md): The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1)… (no CVSS, festivaltts4r)
- [CVE-2016-10201](https://cve.now/CVE-2016-10201.md): Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2016-10202](https://cve.now/CVE-2016-10202.md): Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2016-10203](https://cve.now/CVE-2016-10203.md): Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2016-10204](https://cve.now/CVE-2016-10204.md): SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit… (no CVSS)
- [CVE-2016-10205](https://cve.now/CVE-2016-10205.md): Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie. (no CVSS)
- [CVE-2016-10206](https://cve.now/CVE-2016-10206.md): Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2017-2290](https://cve.now/CVE-2017-2290.md): On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that… (no CVSS, mcollective-puppet-agent plugin)
- [CVE-2017-5193](https://cve.now/CVE-2017-5193.md): The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via… (no CVSS)
- [CVE-2017-5194](https://cve.now/CVE-2017-5194.md): Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an invalid nick… (no CVSS)
- [CVE-2017-5195](https://cve.now/CVE-2017-5195.md): Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color… (no CVSS)
- [CVE-2017-5196](https://cve.now/CVE-2017-5196.md): Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving… (no CVSS)
- [CVE-2017-5356](https://cve.now/CVE-2017-5356.md): Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a… (no CVSS)
- [CVE-2017-5571](https://cve.now/CVE-2017-5571.md): Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used… (no CVSS)
- [CVE-2017-5613](https://cve.now/CVE-2017-5613.md): Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a… (no CVSS)
- [CVE-2017-5614](https://cve.now/CVE-2017-5614.md): Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing… (no CVSS)
- [CVE-2017-5615](https://cve.now/CVE-2017-5615.md): cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location. (no CVSS)
- [CVE-2017-5616](https://cve.now/CVE-2017-5616.md): Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2017-5830](https://cve.now/CVE-2017-5830.md): Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery… (no CVSS)
- [CVE-2017-5831](https://cve.now/CVE-2017-5831.md): Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows… (no CVSS)
- [CVE-2017-5832](https://cve.now/CVE-2017-5832.md): Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script… (no CVSS)
- [CVE-2017-5833](https://cve.now/CVE-2017-5833.md): Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows… (no CVSS)
- [CVE-2017-5834](https://cve.now/CVE-2017-5834.md): The parse\_dict\_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via… (no CVSS)
- [CVE-2017-5835](https://cve.now/CVE-2017-5835.md): libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. (no CVSS)
- [CVE-2017-5836](https://cve.now/CVE-2017-5836.md): The plist\_free\_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer… (no CVSS)
- [CVE-2017-5865](https://cve.now/CVE-2017-5865.md): The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends… (no CVSS)
- [CVE-2017-5866](https://cve.now/CVE-2017-5866.md): The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x… (no CVSS)
- [CVE-2017-5867](https://cve.now/CVE-2017-5867.md): ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a… (no CVSS)
- [CVE-2015-2877](https://cve.now/CVE-2015-2877.md): Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-03-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.