# CVEs published 2017-04-03

48 CVEs were published on April 3, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-7410](https://cve.now/CVE-2017-7410.md): Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote… (no CVSS)
- [CVE-2017-5684](https://cve.now/CVE-2017-5684.md): The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical… (no CVSS, Intel Compute Stick STK2MV64CC)
- [CVE-2017-5685](https://cve.now/CVE-2017-5685.md): The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical… (no CVSS, Intel NUC NUC6i7KYK)
- [CVE-2017-5686](https://cve.now/CVE-2017-5686.md): The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical… (no CVSS, Intel NUC NUC6i5SYSH/K, Intel NUC6i3SYSH/K)
- [CVE-2016-10317](https://cve.now/CVE-2016-10317.md): The fill\_threshhold\_buffer function in base/gxht\_thresh.c in Artifex Software, Inc. (no CVSS)
- [CVE-2017-7397](https://cve.now/CVE-2017-7397.md): BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian… (no CVSS)
- [CVE-2017-7407](https://cve.now/CVE-2017-7407.md): The ourWriteOut function in tool\_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from… (CVSS 2.4)
- [CVE-2017-7402](https://cve.now/CVE-2017-7402.md): Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an… (no CVSS)
- [CVE-2017-5642](https://cve.now/CVE-2017-5642.md): During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. (no CVSS, Apache Software Foundation Apache Ambari)
- [CVE-2013-7450](https://cve.now/CVE-2013-7450.md): Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations. (no CVSS)
- [CVE-2014-1677](https://cve.now/CVE-2014-1677.md): Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information. (no CVSS)
- [CVE-2014-3927](https://cve.now/CVE-2014-3927.md): mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code. (no CVSS)
- [CVE-2014-3928](https://cve.now/CVE-2014-3928.md): Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain… (no CVSS)
- [CVE-2014-3929](https://cve.now/CVE-2014-3929.md): The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might… (no CVSS)
- [CVE-2014-3930](https://cve.now/CVE-2014-3930.md): lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers… (no CVSS)
- [CVE-2017-7400](https://cve.now/CVE-2017-7400.md): OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via… (no CVSS, horizon)
- [CVE-2017-7401](https://cve.now/CVE-2017-7401.md): Incorrect interaction of the parse\_packet() and parse\_part\_sign\_sha256() functions in network.c in collectd 5.7.1 and earlier allows… (no CVSS)
- [CVE-2016-10209](https://cve.now/CVE-2016-10209.md): The archive\_wstring\_append\_from\_mbs function in archive\_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-10210](https://cve.now/CVE-2016-10210.md): libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a… (no CVSS)
- [CVE-2016-10211](https://cve.now/CVE-2016-10211.md): libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted… (no CVSS)
- [CVE-2016-10217](https://cve.now/CVE-2016-10217.md): The pdf14\_open function in base/gdevp14.c in Artifex Software, Inc. (no CVSS)
- [CVE-2016-10218](https://cve.now/CVE-2016-10218.md): The pdf14\_pop\_transparency\_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. (no CVSS)
- [CVE-2016-10219](https://cve.now/CVE-2016-10219.md): The intersect function in base/gxfill.c in Artifex Software, Inc. (no CVSS)
- [CVE-2016-10220](https://cve.now/CVE-2016-10220.md): The gs\_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. (no CVSS)
- [CVE-2016-10221](https://cve.now/CVE-2016-10221.md): The count\_entries function in pdf-layer.c in Artifex Software, Inc. (CVSS 4.3)
- [CVE-2016-10222](https://cve.now/CVE-2016-10222.md): runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to… (no CVSS)
- [CVE-2016-10226](https://cve.now/CVE-2016-10226.md): JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-10312](https://cve.now/CVE-2016-10312.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2016-10313](https://cve.now/CVE-2016-10313.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2016-10314](https://cve.now/CVE-2016-10314.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2016-10315](https://cve.now/CVE-2016-10315.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2016-10316](https://cve.now/CVE-2016-10316.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2017-5923](https://cve.now/CVE-2017-5923.md): libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash)… (no CVSS)
- [CVE-2017-5924](https://cve.now/CVE-2017-5924.md): libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted… (no CVSS)
- [CVE-2017-5949](https://cve.now/CVE-2017-5949.md): JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2017-5950](https://cve.now/CVE-2017-5950.md): The SingleDocParser::HandleNode function in yaml-cpp (aka LibYaml-C++) 0.5.3 allows remote attackers to cause a denial of service (stack… (no CVSS)
- [CVE-2017-5951](https://cve.now/CVE-2017-5951.md): The mem\_get\_bits\_rectangle function in base/gdevmem.c in Artifex Software, Inc. (no CVSS)
- [CVE-2017-6181](https://cve.now/CVE-2017-6181.md): The parse\_char\_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as used in Ruby 2.4.0, allows… (no CVSS)
- [CVE-2017-6194](https://cve.now/CVE-2017-6194.md): The relocs function in libr/bin/p/bin\_bflt.c in radare2 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer… (no CVSS)
- [CVE-2017-6441](https://cve.now/CVE-2017-6441.md): The \_zval\_get\_long\_func\_ex in Zend/zend\_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference… (no CVSS)
- [CVE-2017-6448](https://cve.now/CVE-2017-6448.md): The dalvik\_disassemble function in libr/asm/p/asm\_dalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2017-7378](https://cve.now/CVE-2017-7378.md): The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2017-7379](https://cve.now/CVE-2017-7379.md): The PoDoFo::PdfSimpleEncoding::ConvertToEncoding function in PdfEncoding.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2017-7380](https://cve.now/CVE-2017-7380.md): The doc/PdfPage.cpp:614:20 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and… (no CVSS)
- [CVE-2017-7381](https://cve.now/CVE-2017-7381.md): The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and… (no CVSS)
- [CVE-2017-7382](https://cve.now/CVE-2017-7382.md): The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and… (no CVSS)
- [CVE-2017-7383](https://cve.now/CVE-2017-7383.md): The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and… (no CVSS)
- [CVE-2017-1001000](https://cve.now/CVE-2017-1001000.md): The register\_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-04-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.