# CVEs published 2017-04-20

101 CVEs were published on April 20, 2017: 1 critical, 1 high. Days are UTC.

- [CVE-2016-6368](https://cve.now/CVE-2016-6368.md): A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software… (no CVSS, Cisco Firepower Detection Engine)
- [CVE-2017-3793](https://cve.now/CVE-2017-3793.md): A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco… (no CVSS, Cisco ASA Software and Cisco FTD Software)
- [CVE-2017-3808](https://cve.now/CVE-2017-3808.md): A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM)… (no CVSS, Cisco Unified Communications Manager)
- [CVE-2017-3860](https://cve.now/CVE-2017-3860.md): Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could… (no CVSS, Cisco IOS and IOS XE)
- [CVE-2017-3861](https://cve.now/CVE-2017-3861.md): Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could… (no CVSS, Cisco IOS and IOS XE)
- [CVE-2017-3862](https://cve.now/CVE-2017-3862.md): Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could… (no CVSS, Cisco IOS and IOS XE)
- [CVE-2017-3863](https://cve.now/CVE-2017-3863.md): Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could… (no CVSS, Cisco IOS and IOS XE)
- [CVE-2017-4969](https://cve.now/CVE-2017-4969.md): The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk… (no CVSS, Cloud Foundry Cloud Controller cf-release versions prior to)
- [CVE-2017-6607](https://cve.now/CVE-2017-6607.md): A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to… (no CVSS, Cisco ASA Software)
- [CVE-2017-6608](https://cve.now/CVE-2017-6608.md): A vulnerability in the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) code of Cisco ASA Software could allow an… (no CVSS, Cisco ASA Software)
- [CVE-2017-6609](https://cve.now/CVE-2017-6609.md): A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected… (no CVSS, Cisco ASA Software)
- [CVE-2017-6610](https://cve.now/CVE-2017-6610.md): A vulnerability in the Internet Key Exchange Version 1 (IKEv1) XAUTH code of Cisco ASA Software could allow an authenticated, remote… (no CVSS, Cisco ASA Software)
- [CVE-2017-6611](https://cve.now/CVE-2017-6611.md): A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct… (no CVSS, Cisco Prime Infrastructure)
- [CVE-2017-6613](https://cve.now/CVE-2017-6613.md): A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to… (no CVSS, Cisco Prime Network Registrar)
- [CVE-2017-6614](https://cve.now/CVE-2017-6614.md): A vulnerability in the file-download feature of the web user interface for Cisco FindIT Network Probe Software 1.0.0 could allow an… (no CVSS, Cisco FindIT)
- [CVE-2017-6615](https://cve.now/CVE-2017-6615.md): A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote… (no CVSS, Cisco IOS XE Software)
- [CVE-2017-6616](https://cve.now/CVE-2017-6616.md): A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker… (no CVSS, Cisco Integrated Management Controller)
- [CVE-2017-6617](https://cve.now/CVE-2017-6617.md): A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller… (no CVSS, Cisco Integrated Management Controller)
- [CVE-2017-6618](https://cve.now/CVE-2017-6618.md): A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker… (no CVSS, Cisco Integrated Management Controller)
- [CVE-2017-6619](https://cve.now/CVE-2017-6619.md): A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker… (no CVSS, Cisco Integrated Management Controller)
- [CVE-2015-8285](https://cve.now/CVE-2015-8285.md): The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service. (no CVSS)
- [CVE-2016-1161](https://cve.now/CVE-2016-1161.md): Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500). (no CVSS)
- [CVE-2016-3729](https://cve.now/CVE-2016-3729.md): The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote… (no CVSS, moodle/moodle)
- [CVE-2016-3731](https://cve.now/CVE-2016-3731.md): Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum… (no CVSS)
- [CVE-2016-3732](https://cve.now/CVE-2016-3732.md): The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and… (no CVSS, moodle/moodle)
- [CVE-2016-3733](https://cve.now/CVE-2016-3733.md): The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows… (no CVSS, moodle/moodle)
- [CVE-2016-3734](https://cve.now/CVE-2016-3734.md): Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7… (no CVSS, moodle/moodle)
- [CVE-2016-5401](https://cve.now/CVE-2016-5401.md): Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2016-8923](https://cve.now/CVE-2016-8923.md): IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive… (no CVSS, IBM Curam Social Program Management)
- [CVE-2016-9978](https://cve.now/CVE-2016-9978.md): IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information. (no CVSS, IBM Curam Social Program Management)
- [CVE-2016-9979](https://cve.now/CVE-2016-9979.md): IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. (no CVSS, IBM Curam Social Program Management)
- [CVE-2016-9980](https://cve.now/CVE-2016-9980.md): IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. (no CVSS, IBM Curam Social Program Management)
- [CVE-2017-1122](https://cve.now/CVE-2017-1122.md): IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary… (no CVSS, IBM Security Guardium)
- [CVE-2017-5156](https://cve.now/CVE-2017-5156.md): A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. (no CVSS, Schneider Electric Wonderware InTouch Access Anywhere)
- [CVE-2017-5158](https://cve.now/CVE-2017-5158.md): An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. (no CVSS, Schneider Electric Wonderware InTouch Access Anywhere)
- [CVE-2017-5160](https://cve.now/CVE-2017-5160.md): An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. (no CVSS, Schneider Electric Wonderware InTouch Access Anywhere)
- [CVE-2015-8957](https://cve.now/CVE-2015-8957.md): Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted… (no CVSS)
- [CVE-2015-8958](https://cve.now/CVE-2015-8958.md): coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application… (no CVSS)
- [CVE-2015-8959](https://cve.now/CVE-2015-8959.md): coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS… (no CVSS)
- [CVE-2016-1213](https://cve.now/CVE-2016-1213.md): The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites. (no CVSS)
- [CVE-2016-1214](https://cve.now/CVE-2016-1214.md): Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1215](https://cve.now/CVE-2016-1215.md): Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1216](https://cve.now/CVE-2016-1216.md): Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1217](https://cve.now/CVE-2016-1217.md): Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1218](https://cve.now/CVE-2016-1218.md): SQL injection vulnerability in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1220](https://cve.now/CVE-2016-1220.md): Cybozu Garoon before 4.2.2 does not properly restrict access. (no CVSS)
- [CVE-2016-4818](https://cve.now/CVE-2016-4818.md): DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and… (no CVSS)
- [CVE-2016-4842](https://cve.now/CVE-2016-4842.md): Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read. (no CVSS)
- [CVE-2016-4843](https://cve.now/CVE-2016-4843.md): Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information. (no CVSS)
- [CVE-2016-4844](https://cve.now/CVE-2016-4844.md): Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks. (no CVSS)
- [CVE-2016-4850](https://cve.now/CVE-2016-4850.md): LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code. (no CVSS)
- [CVE-2016-4862](https://cve.now/CVE-2016-4862.md): Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated… (no CVSS)
- [CVE-2016-5010](https://cve.now/CVE-2016-5010.md): coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF… (no CVSS)
- [CVE-2016-7513](https://cve.now/CVE-2016-7513.md): Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via… (no CVSS)
- [CVE-2016-7514](https://cve.now/CVE-2016-7514.md): The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read)… (no CVSS)
- [CVE-2016-7516](https://cve.now/CVE-2016-7516.md): The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a… (no CVSS)
- [CVE-2016-7517](https://cve.now/CVE-2016-7517.md): The EncodeImage function in coders/pict.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a… (no CVSS)
- [CVE-2016-7518](https://cve.now/CVE-2016-7518.md): The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a… (no CVSS)
- [CVE-2016-7520](https://cve.now/CVE-2016-7520.md): Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a… (no CVSS)
- [CVE-2016-7521](https://cve.now/CVE-2016-7521.md): Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a… (no CVSS)
- [CVE-2016-7525](https://cve.now/CVE-2016-7525.md): Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a… (no CVSS)
- [CVE-2016-7526](https://cve.now/CVE-2016-7526.md): coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. (no CVSS)
- [CVE-2016-7527](https://cve.now/CVE-2016-7527.md): coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. (no CVSS)
- [CVE-2016-7530](https://cve.now/CVE-2016-7530.md): The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds… (no CVSS)
- [CVE-2016-7532](https://cve.now/CVE-2016-7532.md): coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file. (no CVSS)
- [CVE-2016-7534](https://cve.now/CVE-2016-7534.md): The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file. (no CVSS)
- [CVE-2016-7535](https://cve.now/CVE-2016-7535.md): coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PSD file. (no CVSS)
- [CVE-2016-7536](https://cve.now/CVE-2016-7536.md): magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted profile. (no CVSS)
- [CVE-2016-7538](https://cve.now/CVE-2016-7538.md): coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. (no CVSS)
- [CVE-2016-7540](https://cve.now/CVE-2016-7540.md): coders/rgf.c in ImageMagick before 6.9.4-10 allows remote attackers to cause a denial of service (assertion failure) by converting an… (no CVSS)
- [CVE-2016-8721](https://cve.now/CVE-2016-8721.md): An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access… (CVSS 9.1, Moxa AWK-3131A WAP)
- [CVE-2017-2784](https://cve.now/CVE-2017-2784.md): An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before… (CVSS 8.1, ARM mbed TLS)
- [CVE-2017-2806](https://cve.now/CVE-2017-2806.md): An exploitable arbitrary read exists in the XLS parsing of the Lexmark Perspective Document Filters conversion functionality. (CVSS 4.3, Lexmark Perceptive Document Filters)
- [CVE-2017-5183](https://cve.now/CVE-2017-5183.md): NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL… (no CVSS, Identity Server)
- [CVE-2016-1219](https://cve.now/CVE-2016-1219.md): Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use. (no CVSS)
- [CVE-2016-4293](https://cve.now/CVE-2016-4293.md): Multiple heap-based buffer overflows in the (1) CBookBase::SetDefTableStyle and (2) CBookBase::SetDefPivotStyle functions in Hancom Office… (no CVSS)
- [CVE-2016-4650](https://cve.now/CVE-2016-4650.md): Heap-based buffer overflow in IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to… (no CVSS)
- [CVE-2016-4847](https://cve.now/CVE-2016-4847.md): Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2016-4849](https://cve.now/CVE-2016-4849.md): Multiple cross-site scripting (XSS) vulnerabilities in Geeklog IVYWE edition 2.1.1 allow remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2016-5409](https://cve.now/CVE-2016-5409.md): Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for… (no CVSS)
- [CVE-2016-5760](https://cve.now/CVE-2016-5760.md): Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot… (no CVSS)
- [CVE-2016-5761](https://cve.now/CVE-2016-5761.md): Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allows remote attackers to inject… (no CVSS)
- [CVE-2016-5762](https://cve.now/CVE-2016-5762.md): Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to… (no CVSS)
- [CVE-2016-6331](https://cve.now/CVE-2016-6331.md): ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title… (no CVSS)
- [CVE-2016-6332](https://cve.now/CVE-2016-6332.md): MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers… (no CVSS)
- [CVE-2016-6333](https://cve.now/CVE-2016-6333.md): Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and… (no CVSS)
- [CVE-2016-6334](https://cve.now/CVE-2016-6334.md): Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4… (no CVSS)
- [CVE-2016-6335](https://cve.now/CVE-2016-6335.md): MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title… (no CVSS)
- [CVE-2016-6336](https://cve.now/CVE-2016-6336.md): MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to… (no CVSS)
- [CVE-2016-6337](https://cve.now/CVE-2016-6337.md): MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the… (no CVSS)
- [CVE-2016-6338](https://cve.now/CVE-2016-6338.md): ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically… (no CVSS)
- [CVE-2016-6341](https://cve.now/CVE-2016-6341.md): oVirt Engine before 4.0.3 does not include DWH\_DB\_PASSWORD in the list of keys to hide in log files, which allows local users to obtain… (no CVSS)
- [CVE-2016-6347](https://cve.now/CVE-2016-6347.md): Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web… (no CVSS, org.jboss.resteasy:resteasy-client)
- [CVE-2017-7718](https://cve.now/CVE-2017-7718.md): hw/display/cirrus\_vga\_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service… (no CVSS)
- [CVE-2017-5190](https://cve.now/CVE-2017-5190.md): NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has… (no CVSS, NAM Identity Server and SAML2 Service Provider)
- [CVE-2017-7692](https://cve.now/CVE-2017-7692.md): SquirrelMail 1.4.22 (and other versions before 20170427\_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file… (no CVSS)
- [CVE-2017-7982](https://cve.now/CVE-2017-7982.md): Integer overflow in the plist\_from\_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to… (no CVSS)
- [CVE-2017-6919](https://cve.now/CVE-2017-6919.md): Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module… (no CVSS, Drupal · drupal/core +1)
- [CVE-2017-7282](https://cve.now/CVE-2017-7282.md): An issue was discovered in Unitrends Enterprise Backup before 9.1.1. (no CVSS)
- [CVE-2017-7283](https://cve.now/CVE-2017-7283.md): An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted… (no CVSS)
- [CVE-2017-7938](https://cve.now/CVE-2017-7938.md): Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of… (CVSS 6.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.