# CVEs published 2017-04-25

37 CVEs were published on April 25, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-8217](https://cve.now/CVE-2017-8217.md): TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is… (no CVSS)
- [CVE-2017-8218](https://cve.now/CVE-2017-8218.md): vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the… (no CVSS)
- [CVE-2017-8219](https://cve.now/CVE-2017-8219.md): TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie… (no CVSS)
- [CVE-2017-8220](https://cve.now/CVE-2017-8220.md): TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP… (no CVSS)
- [CVE-2017-8221](https://cve.now/CVE-2017-8221.md): Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an… (no CVSS)
- [CVE-2017-8222](https://cve.now/CVE-2017-8222.md): Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate stored in… (no CVSS)
- [CVE-2017-8223](https://cve.now/CVE-2017-8223.md): On Wireless IP Camera (P2P) WIFICAM devices, an attacker can use the RTSP server on port 10554/tcp to watch the streaming without… (no CVSS)
- [CVE-2017-8224](https://cve.now/CVE-2017-8224.md): Wireless IP Camera (P2P) WIFICAM devices have a backdoor root account that can be accessed with TELNET. (no CVSS)
- [CVE-2017-8225](https://cve.now/CVE-2017-8225.md): On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. (no CVSS)
- [CVE-2017-3342](https://cve.now/CVE-2017-3342.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3345](https://cve.now/CVE-2017-3345.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3347](https://cve.now/CVE-2017-3347.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3355](https://cve.now/CVE-2017-3355.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3356](https://cve.now/CVE-2017-3356.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3434](https://cve.now/CVE-2017-3434.md): Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Audience workbench). (no CVSS, Oracle One-to-One Fulfillment)
- [CVE-2017-8115](https://cve.now/CVE-2017-8115.md): Directory traversal in setup/processors/url\_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow… (no CVSS)
- [CVE-2017-1149](https://cve.now/CVE-2017-1149.md): IBM UrbanCode Deploy (UCD) 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error… (no CVSS, IBM UrbanCode Deploy)
- [CVE-2017-1274](https://cve.now/CVE-2017-1274.md): IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to… (no CVSS, IBM Domino)
- [CVE-2017-7983](https://cve.now/CVE-2017-7983.md): In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent using the JMail API leaked the used PHPMailer version in the mail headers. (no CVSS)
- [CVE-2017-7984](https://cve.now/CVE-2017-7984.md): In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering leads to XSS in the template manager component. (no CVSS)
- [CVE-2017-7985](https://cve.now/CVE-2017-7985.md): In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various… (no CVSS)
- [CVE-2017-7986](https://cve.now/CVE-2017-7986.md): In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various… (no CVSS)
- [CVE-2017-7987](https://cve.now/CVE-2017-7987.md): In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate escaping of file and folder names leads to XSS vulnerabilities in the template… (no CVSS)
- [CVE-2017-7988](https://cve.now/CVE-2017-7988.md): In Joomla! 1.6.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of form contents allows overwriting the author of an article. (no CVSS)
- [CVE-2017-7989](https://cve.now/CVE-2017-7989.md): In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they… (no CVSS)
- [CVE-2017-8057](https://cve.now/CVE-2017-8057.md): In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting. (no CVSS)
- [CVE-2017-8109](https://cve.now/CVE-2017-8109.md): The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting… (no CVSS, salt)
- [CVE-2017-8110](https://cve.now/CVE-2017-8110.md): www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php. (no CVSS)
- [CVE-2016-8030](https://cve.now/CVE-2016-8030.md): A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers… (no CVSS, McAfee VirusScan Enterprise)
- [CVE-2017-5625](https://cve.now/CVE-2017-5625.md): In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the… (no CVSS)
- [CVE-2017-7221](https://cve.now/CVE-2017-7221.md): OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users… (no CVSS)
- [CVE-2017-7477](https://cve.now/CVE-2017-7477.md): Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a… (no CVSS, Linux kernel)
- [CVE-2017-5047](https://cve.now/CVE-2017-5047.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a… (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)
- [CVE-2017-5048](https://cve.now/CVE-2017-5048.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a… (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)
- [CVE-2017-5049](https://cve.now/CVE-2017-5049.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a… (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)
- [CVE-2017-5050](https://cve.now/CVE-2017-5050.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a… (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)
- [CVE-2017-5051](https://cve.now/CVE-2017-5051.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a… (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.