# CVEs published 2017-02-07

34 CVEs were published on February 7, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2015-7599](https://cve.now/CVE-2015-7599.md): Integer overflow in the \_authenticate function in svc\_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) (no CVSS)
- [CVE-2015-8322](https://cve.now/CVE-2015-8322.md): NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors. (no CVSS)
- [CVE-2015-8544](https://cve.now/CVE-2015-8544.md): NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive information via unspe (no CVSS)
- [CVE-2016-1502](https://cve.now/CVE-2016-1502.md): NetApp SnapCenter Server 1.0 and 1.0P1 allows remote attackers to partially bypass authentication and then list and delete backups via unspe (no CVSS)
- [CVE-2016-1894](https://cve.now/CVE-2016-1894.md): NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vectors. (no CVSS)
- [CVE-2016-2403](https://cve.now/CVE-2016-2403.md): Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid us (no CVSS, symfony/security-core · symfony/security +1)
- [CVE-2016-3063](https://cve.now/CVE-2016-3063.md): Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authentica (no CVSS)
- [CVE-2016-3124](https://cve.now/CVE-2016-3124.md): The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors (no CVSS, simplesamlphp/simplesamlphp)
- [CVE-2016-3180](https://cve.now/CVE-2016-3180.md): Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers to bypass the PGP si (no CVSS)
- [CVE-2016-4341](https://cve.now/CVE-2016-4341.md): NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vectors. (no CVSS)
- [CVE-2016-5372](https://cve.now/CVE-2016-5372.md): Cross-site request forgery (CSRF) vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers to hijack the authen (no CVSS)
- [CVE-2016-5711](https://cve.now/CVE-2016-5711.md): NetApp Virtual Storage Console for VMware vSphere before 6.2.1 uses a non-unique certificate, which allows remote attackers to conduct man-i (no CVSS)
- [CVE-2016-6495](https://cve.now/CVE-2016-6495.md): NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain information about the volumes configured for H (no CVSS)
- [CVE-2016-6667](https://cve.now/CVE-2016-6667.md): NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attack (no CVSS)
- [CVE-2016-9639](https://cve.now/CVE-2016-9639.md): Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. (no CVSS, salt)
- [CVE-2016-3020](https://cve.now/CVE-2016-3020.md): IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by imprope (no CVSS, IBM Access Manager)
- [CVE-2016-6092](https://cve.now/CVE-2016-6092.md): IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user. (no CVSS, IBM Key Lifecycle Manager)
- [CVE-2016-6094](https://cve.now/CVE-2016-6094.md): IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, u (no CVSS, IBM Key Lifecycle Manager)
- [CVE-2016-6096](https://cve.now/CVE-2016-6096.md): IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. (no CVSS, IBM Key Lifecycle Manager)
- [CVE-2016-6097](https://cve.now/CVE-2016-6097.md): IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system. (no CVSS, IBM Key Lifecycle Manager)
- [CVE-2016-6104](https://cve.now/CVE-2016-6104.md): IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of (no CVSS, IBM Key Lifecycle Manager)
- [CVE-2015-5677](https://cve.now/CVE-2015-5677.md): bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain (no CVSS)
- [CVE-2015-8608](https://cve.now/CVE-2015-8608.md): The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and po (no CVSS)
- [CVE-2016-1504](https://cve.now/CVE-2016-1504.md): dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to the option length. (no CVSS)
- [CVE-2016-2539](https://cve.now/CVE-2016-2539.md): Cross-site request forgery (CSRF) vulnerability in install\_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authenti (no CVSS)
- [CVE-2016-2779](https://cve.now/CVE-2016-2779.md): runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the te (no CVSS)
- [CVE-2016-2781](https://cve.now/CVE-2016-2781.md): chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, whi (CVSS 4.6)
- [CVE-2016-6131](https://cve.now/CVE-2016-6131.md): The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle i (no CVSS)
- [CVE-2016-6175](https://cve.now/CVE-2016-6175.md): Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural fo (no CVSS)
- [CVE-2016-6199](https://cve.now/CVE-2016-6199.md): ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object. (no CVSS)
- [CVE-2016-7164](https://cve.now/CVE-2016-7164.md): The construct function in puff.cpp in Libtorrent 1.1.0 allows remote torrent trackers to cause a denial of service (segmentation fault and c (no CVSS)
- [CVE-2016-7400](https://cve.now/CVE-2016-7400.md): Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id (no CVSS)
- [CVE-2014-9914](https://cve.now/CVE-2014-9914.md): Race condition in the ip4\_datagram\_release\_cb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain p (no CVSS)
- [CVE-2016-10044](https://cve.now/CVE-2016-10044.md): The aio\_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for loc (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-02-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.