# CVEs published 2017-03-20

63 CVEs were published on March 20, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-4926](https://cve.now/CVE-2016-4926.md): Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web… (no CVSS)
- [CVE-2016-4927](https://cve.now/CVE-2016-4927.md): Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is… (no CVSS)
- [CVE-2016-4928](https://cve.now/CVE-2016-4928.md): Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on… (no CVSS)
- [CVE-2016-4929](https://cve.now/CVE-2016-4929.md): Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user. (no CVSS)
- [CVE-2016-4930](https://cve.now/CVE-2016-4930.md): Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform… (no CVSS)
- [CVE-2016-4931](https://cve.now/CVE-2016-4931.md): XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. (no CVSS)
- [CVE-2016-6816](https://cve.now/CVE-2016-6816.md): The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the… (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2012-5361](https://cve.now/CVE-2012-5361.md): Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file. (no CVSS)
- [CVE-2014-9841](https://cve.now/CVE-2014-9841.md): The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors… (no CVSS)
- [CVE-2014-9842](https://cve.now/CVE-2014-9842.md): Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2014-9843](https://cve.now/CVE-2014-9843.md): The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors. (no CVSS)
- [CVE-2014-9844](https://cve.now/CVE-2014-9844.md): The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read)… (no CVSS)
- [CVE-2014-9845](https://cve.now/CVE-2014-9845.md): The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib… (no CVSS)
- [CVE-2014-9846](https://cve.now/CVE-2014-9846.md): Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact. (no CVSS)
- [CVE-2014-9847](https://cve.now/CVE-2014-9847.md): The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact. (no CVSS)
- [CVE-2014-9848](https://cve.now/CVE-2014-9848.md): Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption). (no CVSS)
- [CVE-2014-9849](https://cve.now/CVE-2014-9849.md): The png coder in ImageMagick allows remote attackers to cause a denial of service (crash). (no CVSS)
- [CVE-2014-9850](https://cve.now/CVE-2014-9850.md): Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption). (no CVSS)
- [CVE-2014-9851](https://cve.now/CVE-2014-9851.md): ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash). (no CVSS)
- [CVE-2015-1610](https://cve.now/CVE-2015-1610.md): hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka… (no CVSS)
- [CVE-2015-8954](https://cve.now/CVE-2015-8954.md): The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote… (no CVSS)
- [CVE-2015-8983](https://cve.now/CVE-2015-8983.md): Integer overflow in the \_IO\_wstr\_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows… (no CVSS)
- [CVE-2015-8984](https://cve.now/CVE-2015-8984.md): The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of… (no CVSS)
- [CVE-2015-8985](https://cve.now/CVE-2015-8985.md): The pop\_fail\_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service… (no CVSS)
- [CVE-2016-10214](https://cve.now/CVE-2016-10214.md): Memory leak in the virgl\_resource\_attach\_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of… (no CVSS)
- [CVE-2016-2406](https://cve.now/CVE-2016-2406.md): The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users… (no CVSS)
- [CVE-2016-2981](https://cve.now/CVE-2016-2981.md): An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-5857](https://cve.now/CVE-2016-5857.md): The Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code within the context of the kernel via a… (no CVSS)
- [CVE-2016-8973](https://cve.now/CVE-2016-8973.md): IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious… (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2016-9165](https://cve.now/CVE-2016-9165.md): The get\_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure… (no CVSS)
- [CVE-2016-9694](https://cve.now/CVE-2016-9694.md): IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2016-9696](https://cve.now/CVE-2016-9696.md): IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to HTML injection. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2016-9697](https://cve.now/CVE-2016-9697.md): An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2017-1134](https://cve.now/CVE-2017-1134.md): IBM Reliable Scalable Cluster Technology could allow a local user to escalate their privileges to gain root access. (no CVSS, IBM Tivoli System Automation for Multiplatforms)
- [CVE-2017-1145](https://cve.now/CVE-2017-1145.md): IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a… (no CVSS, IBM WebSphere MQ)
- [CVE-2017-1146](https://cve.now/CVE-2017-1146.md): IBM Content Navigator 2.0.3 and 3.0.0 are vulnerable to cross-site scripting. (no CVSS, IBM Content Navigator)
- [CVE-2017-1151](https://cve.now/CVE-2017-1151.md): IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor… (no CVSS, IBM WebSphere Application Server)
- [CVE-2017-1155](https://cve.now/CVE-2017-1155.md): IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to another user's reports using a… (no CVSS, IBM Algo One)
- [CVE-2017-5618](https://cve.now/CVE-2017-5618.md): GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking… (no CVSS)
- [CVE-2017-5930](https://cve.now/CVE-2017-5930.md): The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the… (no CVSS)
- [CVE-2017-5956](https://cve.now/CVE-2017-5956.md): The vrend\_draw\_vbo function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array… (no CVSS)
- [CVE-2017-5987](https://cve.now/CVE-2017-5987.md): The sdhci\_sdma\_transfer\_multi\_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to… (no CVSS)
- [CVE-2017-6058](https://cve.now/CVE-2017-6058.md): Buffer overflow in NetRxPkt::ehdr\_buf in hw/net/net\_rx\_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the… (no CVSS)
- [CVE-2017-6178](https://cve.now/CVE-2017-6178.md): The IofCallDriver function in USBPcap 1.1.0.0 allows local users to gain privileges via a crafted 0x00090028 IOCTL call, which triggers a… (no CVSS)
- [CVE-2017-6318](https://cve.now/CVE-2017-6318.md): saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE\_NET\_CONTROL\_OPTION packet. (no CVSS)
- [CVE-2017-6356](https://cve.now/CVE-2017-6356.md): Palo Alto Networks Terminal Services (aka TS) Agent 6.0, 7.0, and 8.0 before 8.0.1 uses weak permissions for unspecified resources, which… (no CVSS)
- [CVE-2017-6550](https://cve.now/CVE-2017-6550.md): Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands… (no CVSS)
- [CVE-2017-6803](https://cve.now/CVE-2017-6803.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP… (no CVSS)
- [CVE-2017-6805](https://cve.now/CVE-2017-6805.md): Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via… (no CVSS)
- [CVE-2017-6829](https://cve.now/CVE-2017-6829.md): The decodeSample function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2017-6830](https://cve.now/CVE-2017-6830.md): Heap-based buffer overflow in the alaw2linear\_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers… (no CVSS)
- [CVE-2017-6831](https://cve.now/CVE-2017-6831.md): Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3… (no CVSS)
- [CVE-2017-6832](https://cve.now/CVE-2017-6832.md): Heap-based buffer overflow in the decodeBlock in MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2… (no CVSS)
- [CVE-2017-6833](https://cve.now/CVE-2017-6833.md): The runPull function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a… (no CVSS)
- [CVE-2017-6834](https://cve.now/CVE-2017-6834.md): Heap-based buffer overflow in the ulaw2linear\_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3… (no CVSS)
- [CVE-2017-6835](https://cve.now/CVE-2017-6835.md): The reset1 function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a… (no CVSS)
- [CVE-2017-6836](https://cve.now/CVE-2017-6836.md): Heap-based buffer overflow in the Expand3To4Module::run function in libaudiofile/modules/SimpleModule.h in Audio File Library (aka… (no CVSS)
- [CVE-2017-6837](https://cve.now/CVE-2017-6837.md): WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a… (no CVSS)
- [CVE-2017-6838](https://cve.now/CVE-2017-6838.md): Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2017-6839](https://cve.now/CVE-2017-6839.md): Integer overflow in modules/MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2017-7187](https://cve.now/CVE-2017-7187.md): The sg\_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based… (no CVSS)
- [CVE-2014-9938](https://cve.now/CVE-2014-9938.md): contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository… (no CVSS)
- [CVE-2017-7186](https://cve.now/CVE-2017-7186.md): libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.