# CVEs published 2017-03-07

64 CVEs were published on March 7, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-2636](https://cve.now/CVE-2017-2636.md): Race condition in drivers/tty/n\_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of… (no CVSS)
- [CVE-2016-10200](https://cve.now/CVE-2016-10200.md): Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a… (no CVSS)
- [CVE-2016-9245](https://cve.now/CVE-2016-9245.md): In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…)
- [CVE-2017-6511](https://cve.now/CVE-2017-6511.md): andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in… (CVSS 6.1)
- [CVE-2017-5681](https://cve.now/CVE-2017-5681.md): The RSA-CRT implementation in the Intel QuickAssist Technology (QAT) Engine for OpenSSL versions prior to 0.5.19 may allow remote… (no CVSS, Intel Quick Assist Technology)
- [CVE-2016-8940](https://cve.now/CVE-2016-8940.md): IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. (no CVSS, IBM Tivoli Storage Manager)
- [CVE-2016-8971](https://cve.now/CVE-2016-8971.md): IBM WebSphere MQ 8.0 could allow an authenticated user with queue manager permissions to cause a segmentation fault which would result in… (no CVSS, IBM WebSphere MQ)
- [CVE-2016-9693](https://cve.now/CVE-2016-9693.md): IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. (no CVSS, IBM Business Process Manager Advanced)
- [CVE-2016-9720](https://cve.now/CVE-2016-9720.md): IBM QRadar 7.2 discloses sensitive information to unauthorized users. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9723](https://cve.now/CVE-2016-9723.md): IBM QRadar 7.2 is vulnerable to cross-site scripting. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9724](https://cve.now/CVE-2016-9724.md): IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9725](https://cve.now/CVE-2016-9725.md): IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing (CORS), which is a mechanism that allows web sites to request… (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9726](https://cve.now/CVE-2016-9726.md): IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. (no CVSS, IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7…)
- [CVE-2016-9727](https://cve.now/CVE-2016-9727.md): IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9728](https://cve.now/CVE-2016-9728.md): IBM Qradar 7.2 is vulnerable to SQL injection. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9729](https://cve.now/CVE-2016-9729.md): IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to… (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9730](https://cve.now/CVE-2016-9730.md): IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and… (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9740](https://cve.now/CVE-2016-9740.md): IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of… (no CVSS, IBM QRadar SIEM)
- [CVE-2017-1124](https://cve.now/CVE-2017-1124.md): IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. (no CVSS, IBM Maximo Asset Management)
- [CVE-2017-1133](https://cve.now/CVE-2017-1133.md): IBM QRadar 7.2 is vulnerable to cross-site scripting. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-4946](https://cve.now/CVE-2016-4946.md): Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2016-4947](https://cve.now/CVE-2016-4947.md): Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete. (no CVSS, gethue)
- [CVE-2016-4948](https://cve.now/CVE-2016-4948.md): Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2016-4949](https://cve.now/CVE-2016-4949.md): Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in… (no CVSS)
- [CVE-2016-4950](https://cve.now/CVE-2016-4950.md): Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions. (no CVSS)
- [CVE-2016-6239](https://cve.now/CVE-2016-6239.md): The mmap extension \_\_MAP\_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large… (no CVSS)
- [CVE-2016-6240](https://cve.now/CVE-2016-6240.md): Integer truncation error in the amap\_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel… (no CVSS)
- [CVE-2016-6241](https://cve.now/CVE-2016-6241.md): Integer overflow in the amap\_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges… (no CVSS)
- [CVE-2016-6242](https://cve.now/CVE-2016-6242.md): OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a… (no CVSS)
- [CVE-2016-6243](https://cve.now/CVE-2016-6243.md): thrsleep in kern/kern\_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in… (no CVSS)
- [CVE-2016-6245](https://cve.now/CVE-2016-6245.md): OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call. (no CVSS)
- [CVE-2016-6246](https://cve.now/CVE-2016-6246.md): OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a… (no CVSS)
- [CVE-2016-6247](https://cve.now/CVE-2016-6247.md): OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode… (no CVSS)
- [CVE-2016-6255](https://cve.now/CVE-2016-6255.md): Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request… (no CVSS)
- [CVE-2016-6350](https://cve.now/CVE-2016-6350.md): OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path… (no CVSS)
- [CVE-2016-6522](https://cve.now/CVE-2016-6522.md): Integer overflow in the uvm\_map\_isavail function in uvm/uvm\_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel… (no CVSS)
- [CVE-2016-7135](https://cve.now/CVE-2016-7135.md): Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary… (no CVSS, plone)
- [CVE-2016-7136](https://cve.now/CVE-2016-7136.md): z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a… (no CVSS, plone)
- [CVE-2016-7137](https://cve.now/CVE-2016-7137.md): Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers… (no CVSS, plone)
- [CVE-2016-7138](https://cve.now/CVE-2016-7138.md): Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x… (no CVSS, plone)
- [CVE-2016-7139](https://cve.now/CVE-2016-7139.md): Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x… (no CVSS, plone)
- [CVE-2016-7140](https://cve.now/CVE-2016-7140.md): Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x… (no CVSS, plone)
- [CVE-2016-7780](https://cve.now/CVE-2016-7780.md): SQL injection vulnerability in cron/find\_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2016-7781](https://cve.now/CVE-2016-7781.md): SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote… (no CVSS)
- [CVE-2016-7782](https://cve.now/CVE-2016-7782.md): SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute… (no CVSS)
- [CVE-2016-7783](https://cve.now/CVE-2016-7783.md): SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute… (no CVSS)
- [CVE-2016-7784](https://cve.now/CVE-2016-7784.md): SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows… (no CVSS)
- [CVE-2016-7788](https://cve.now/CVE-2016-7788.md): SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to… (no CVSS)
- [CVE-2016-7789](https://cve.now/CVE-2016-7789.md): SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute… (no CVSS)
- [CVE-2016-8863](https://cve.now/CVE-2016-8863.md): Heap-based buffer overflow in the create\_url\_list function in gena/gena\_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows… (no CVSS)
- [CVE-2016-9019](https://cve.now/CVE-2016-9019.md): SQL injection vulnerability in the activate\_address function in framework/modules/addressbook/controllers/addressController.php in… (no CVSS)
- [CVE-2016-9020](https://cve.now/CVE-2016-9020.md): SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote… (no CVSS)
- [CVE-2016-9087](https://cve.now/CVE-2016-9087.md): SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier… (no CVSS)
- [CVE-2016-9643](https://cve.now/CVE-2016-9643.md): The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large… (no CVSS)
- [CVE-2017-6509](https://cve.now/CVE-2017-6509.md): Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php (id parameter). (no CVSS)
- [CVE-2013-5653](https://cve.now/CVE-2013-5653.md): The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via… (no CVSS)
- [CVE-2016-10040](https://cve.now/CVE-2016-10040.md): Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a… (no CVSS)
- [CVE-2016-5315](https://cve.now/CVE-2016-5315.md): The setByteArray function in tif\_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds… (no CVSS)
- [CVE-2016-6244](https://cve.now/CVE-2016-6244.md): The sys\_thrsigdivert function in kern/kern\_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic)… (no CVSS)
- [CVE-2016-7145](https://cve.now/CVE-2016-7145.md): The m\_authenticate function in ircd/m\_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and… (no CVSS)
- [CVE-2016-9148](https://cve.now/CVE-2016-9148.md): Cross-site scripting (XSS) vulnerability in CA Service Desk Manager (formerly CA Service Desk) 12.9 and 14.1 allows remote attackers to… (no CVSS)
- [CVE-2016-9164](https://cve.now/CVE-2016-9164.md): Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) 8.4 SP1 and… (no CVSS)
- [CVE-2017-3159](https://cve.now/CVE-2017-3159.md): Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. (no CVSS, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2017-6508](https://cve.now/CVE-2017-6508.md): CRLF injection vulnerability in the url\_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-03-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.