# CVEs published 2017-04-06

32 CVEs were published on April 6, 2017: 3 critical, 1 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2015-4673](https://cve.now/CVE-2015-4673.md): Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script… (no CVSS)
- [CVE-2016-1000307](https://cve.now/CVE-2016-1000307.md): Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web… (no CVSS)
- [CVE-2017-7576](https://cve.now/CVE-2017-7576.md): DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username of energetic and password of wireless)… (no CVSS)
- [CVE-2015-8965](https://cve.now/CVE-2015-8965.md): Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the… (no CVSS)
- [CVE-2016-6809](https://cve.now/CVE-2016-6809.md): Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. (no CVSS, org.apache.tika:tika-core)
- [CVE-2016-8735](https://cve.now/CVE-2016-8735.md): Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before (CVSS 9.8, KEV, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2017-7574](https://cve.now/CVE-2017-7574.md): Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. (CVSS 10.0)
- [CVE-2017-7575](https://cve.now/CVE-2017-7575.md): Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a… (CVSS 9.8)
- [CVE-2016-5349](https://cve.now/CVE-2016-5349.md): The high level operating systems (HLOS) was not providing sufficient memory address information to ensure that secure applications inside… (no CVSS, Qualcomm Snapdragon 800, 600, 400,)
- [CVE-2017-4964](https://cve.now/CVE-2017-4964.md): Cloud Foundry Foundation BOSH Azure CPI v22 could potentially allow a maliciously crafted stemcell to execute arbitrary code on VMs… (no CVSS, Cloud Foundry Foundation BOSH Azure CPI Release)
- [CVE-2016-10320](https://cve.now/CVE-2016-10320.md): textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. (no CVSS)
- [CVE-2016-9194](https://cve.now/CVE-2016-9194.md): A vulnerability in 802.11 Wireless Multimedia Extensions (WME) action frame processing in Cisco Wireless LAN Controller (WLC) Software… (no CVSS, Cisco Wireless LAN Controller)
- [CVE-2016-9219](https://cve.now/CVE-2016-9219.md): A vulnerability with IPv6 UDP ingress packet processing in Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated… (no CVSS, Cisco Wireless LAN Controller)
- [CVE-2017-3832](https://cve.now/CVE-2017-3832.md): A vulnerability in the web management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote… (no CVSS, Cisco Wireless LAN Controller)
- [CVE-2017-3834](https://cve.now/CVE-2017-3834.md): A vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running Cisco Mobility Express Software could… (no CVSS, Cisco Aironet 1830 Series and 1850 Series Access Points)
- [CVE-2017-7572](https://cve.now/CVE-2017-7572.md): The \_checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit… (no CVSS)
- [CVE-2017-6884](https://cve.now/CVE-2017-6884.md): A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. (CVSS 8.8, KEV)
- [CVE-2017-7569](https://cve.now/CVE-2017-7569.md): In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the… (no CVSS)
- [CVE-2017-7571](https://cve.now/CVE-2017-7571.md): public/rolechangeadmin in Faveo 1.9.3 allows CSRF. (no CVSS)
- [CVE-2017-7566](https://cve.now/CVE-2017-7566.md): MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. (no CVSS)
- [CVE-2016-10319](https://cve.now/CVE-2016-10319.md): In ARM Trusted Firmware 1.2 and 1.3, a malformed firmware update SMC can result in copying unexpectedly large data into secure memory… (no CVSS)
- [CVE-2017-2675](https://cve.now/CVE-2017-2675.md): Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation vulnerability in the installer part. (no CVSS, Objective Development Software Little Snitch)
- [CVE-2017-7237](https://cve.now/CVE-2017-7237.md): The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks… (no CVSS)
- [CVE-2017-7565](https://cve.now/CVE-2017-7565.md): Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041. (no CVSS)
- [CVE-2017-0305](https://cve.now/CVE-2017-0305.md): F5 SSL Intercept iApp version 1.5.0 - 1.5.7 is vulnerable to an unauthenticated, remote attack that may allow modification of the BIG-IP… (no CVSS, F5 Networks SSL Intercept iApp version)
- [CVE-2017-5887](https://cve.now/CVE-2017-5887.md): WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late… (no CVSS)
- [CVE-2017-6130](https://cve.now/CVE-2017-6130.md): F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed… (no CVSS, F5 Networks SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orches…)
- [CVE-2017-6968](https://cve.now/CVE-2017-6968.md): GMV Checker ATM Security prior to 5.0.18 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka… (no CVSS)
- [CVE-2017-7192](https://cve.now/CVE-2017-7192.md): WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it… (no CVSS)
- [CVE-2017-7452](https://cve.now/CVE-2017-7452.md): The iwbmp\_read\_info\_header function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial… (no CVSS)
- [CVE-2017-7453](https://cve.now/CVE-2017-7453.md): The iwgif\_record\_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2017-7454](https://cve.now/CVE-2017-7454.md): The iwgif\_record\_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.