CVEs published April 14, 2017
60 CVEs were published on April 14, 2017: 0 critical, 0 high. Browse them by severity, product and exploitation status.
- Published
- 60
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 60
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM Tivoli Application Dependency Discovery Manager
- 3
- com.fasterxml.jackson.dataformat:jackson-dataformat-xml
- 1
- IBM Financial Transaction Manager
- 1
- IBM Spectrum LSF
- 1
Medium, low and unrated 60
- CVE-2016-0727The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on…
- CVE-2016-1713Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in…
- CVE-2016-3104mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and…
- CVE-2016-4455The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for…
- CVE-2016-4875Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before…
- CVE-2016-4888Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web…
- CVE-2016-4889ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to…
- CVE-2016-4890ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to…
- CVE-2016-5309The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email…
- CVE-2016-5310The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email…
- CVE-2016-5312Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users…
- CVE-2016-6299The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted…
- CVE-2016-6489The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.
- CVE-2016-7032sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application…
- CVE-2016-7051XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers…com.fasterxml.jackson.dataformat:jackson-dataformat-xml
- CVE-2016-7060The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physically proximate…
- CVE-2016-8602The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application…
- CVE-2017-6554pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to write to arbitrary…
- CVE-2017-7188Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl…
- CVE-2017-7357Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by…
- CVE-2017-7690Proxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by replacing the KLoader binary with a Trojan horse…
- CVE-2017-7696SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large…
- CVE-2017-7717SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote…
- CVE-2017-7871trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter).
- CVE-2017-7875In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an…
Show all 60 entriesShow fewer entries
- CVE-2017-7877CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations.
- CVE-2017-7878SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database.
- CVE-2017-7879SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database.
- CVE-2015-6567Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the…
- CVE-2015-6568Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the…
- CVE-2016-8925IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to include arbitrary files which could…IBM Tivoli Application Dependency Discovery Manager
- CVE-2016-8926IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or data that is…IBM Tivoli Application Dependency Discovery Manager
- CVE-2016-8927IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site scripting.IBM Tivoli Application Dependency Discovery Manager
- CVE-2017-1152IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to…IBM Financial Transaction Manager
- CVE-2017-1205IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges and obtain root…IBM Spectrum LSF
- CVE-2015-8356Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute…
- CVE-2017-7217The Management Web Interface in Palo Alto Networks PAN-OS before 7.0.14 and 7.1.x before 7.1.9 allows remote attackers to write to export…
- CVE-2017-7218The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to gain privileges via…
- CVE-2017-7408Palo Alto Networks Traps ESM Console before 3.4.4 allows attackers to cause a denial of service by leveraging improper validation of…
- CVE-2017-7455Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.
- CVE-2017-7456Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login…
- CVE-2017-7457XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure.
- CVE-2017-7643Proxifier for Mac before 2.19 allows local users to gain privileges via the first parameter to the KLoader setuid program.
- CVE-2016-10327LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF…
- CVE-2016-10328FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in…
- CVE-2017-7856LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1…
- CVE-2017-7857FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in…
- CVE-2017-7858FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face…
- CVE-2017-7859FFmpeg before 2017-03-05 has an out-of-bounds write caused by a heap-based buffer overflow related to the ff_h264_slice_context_init…
- CVE-2017-7860Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in…
- CVE-2017-7861Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c.
- CVE-2017-7862FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in…
- CVE-2017-7863FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in…
- CVE-2017-7864FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in…
- CVE-2017-7865FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA…
- CVE-2017-7866FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in…
- CVE-2017-7867International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow…
- CVE-2017-7868International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow…
- CVE-2017-7869GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the…
- CVE-2017-7870LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert…