CVEs published February 7, 2017
34 CVEs were published on February 7, 2017: 0 critical, 0 high.
- Published
- 34
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- IBM Key Lifecycle Manager
- 5
- IBM Access Manager
- 1
- salt
- 1
- simplesamlphp/simplesamlphp
- 1
- symfony/security-core · symfony/security +1
- 1
Medium, low and unrated 34
- CVE-2015-7599Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC)
- CVE-2015-8322NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
- CVE-2015-8544NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive information via unspe
- CVE-2016-1502NetApp SnapCenter Server 1.0 and 1.0P1 allows remote attackers to partially bypass authentication and then list and delete backups via unspe
- CVE-2016-1894NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vectors.
- CVE-2016-2403Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid ussymfony/security-core · symfony/security +1
- CVE-2016-3063Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authentica
- CVE-2016-3124The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectorssimplesamlphp/simplesamlphp
- CVE-2016-3180Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers to bypass the PGP si
- CVE-2016-4341NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vectors.
- CVE-2016-5372Cross-site request forgery (CSRF) vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers to hijack the authen
- CVE-2016-5711NetApp Virtual Storage Console for VMware vSphere before 6.2.1 uses a non-unique certificate, which allows remote attackers to conduct man-i
- CVE-2016-6495NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain information about the volumes configured for H
- CVE-2016-6667NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attack
- CVE-2016-9639Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.salt
- CVE-2016-3020IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by impropeIBM Access Manager
- CVE-2016-6092IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user.IBM Key Lifecycle Manager
- CVE-2016-6094IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, uIBM Key Lifecycle Manager
- CVE-2016-6096IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting.IBM Key Lifecycle Manager
- CVE-2016-6097IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system.IBM Key Lifecycle Manager
- CVE-2016-6104IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of IBM Key Lifecycle Manager
- CVE-2015-5677bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain
- CVE-2015-8608The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and po
- CVE-2016-1504dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to the option length.
- CVE-2016-2539Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authenti
- CVE-2016-2779runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the te
- CVE-2016-2781chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, whi
- CVE-2016-6131The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle i
- CVE-2016-6175Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural fo
- CVE-2016-6199ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.
- CVE-2016-7164The construct function in puff.cpp in Libtorrent 1.1.0 allows remote torrent trackers to cause a denial of service (segmentation fault and c
- CVE-2016-7400Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id
- CVE-2014-9914Race condition in the ip4_datagram_release_cb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain p
- CVE-2016-10044The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for loc