CVEs published March 3, 2017
50 CVEs were published on March 3, 2017: 0 critical, 0 high.
- Published
- 50
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Umbraco.CMS
- 2
- BlackBerry Good Control Server versions earlier than
- 1
- espeak-ruby
- 1
- festivaltts4r
- 1
- Lenovo Group ThinkServer RD350, RD450, RD550, RD650, TD350
- 1
- mcollective-puppet-agent plugin
- 1
- pysaml2
- 1
Medium, low and unrated 50
- CVE-2016-10070Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denia
- CVE-2016-3127An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 alloBlackBerry Good Control Server versions earlier than
- CVE-2016-8236Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM veLenovo Group ThinkServer RD350, RD450, RD550, RD650, TD350
- CVE-2016-10061The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which al
- CVE-2016-10065The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application
- CVE-2016-10066Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of se
- CVE-2015-8813The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackeUmbraco.CMS
- CVE-2015-8814Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks Umbraco.CMS
- CVE-2015-8815Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML vi
- CVE-2016-6882MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key inf
- CVE-2016-6883MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher varian
- CVE-2016-6884TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial of service (out-of-bou
- CVE-2016-7406Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in
- CVE-2016-7407The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.
- CVE-2016-7408The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.
- CVE-2016-7409The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v
- CVE-2016-7969The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds re
- CVE-2016-7970Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service
- CVE-2016-7972The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory a
- CVE-2016-10127PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.pysaml2
- CVE-2016-10193The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the espeak-ruby
- CVE-2016-10194The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speefestivaltts4r
- CVE-2016-10201Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via t
- CVE-2016-10202Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via t
- CVE-2016-10203Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via t
- CVE-2016-10204SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter
- CVE-2016-10205Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.
- CVE-2016-10206Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users
- CVE-2017-2290On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that willmcollective-puppet-agent plugin
- CVE-2017-5193The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a
- CVE-2017-5194Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an invalid nick message
- CVE-2017-5195Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color c
- CVE-2017-5196Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings
- CVE-2017-5356Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting
- CVE-2017-5571Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in
- CVE-2017-5613Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a temp
- CVE-2017-5614Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing at
- CVE-2017-5615cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.
- CVE-2017-5616Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the adde
- CVE-2017-5830Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery sc
- CVE-2017-5831Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote
- CVE-2017-5832Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or
- CVE-2017-5833Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows rem
- CVE-2017-5834The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a
- CVE-2017-5835libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.
- CVE-2017-5836The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer n
- CVE-2017-5865The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends diff
- CVE-2017-5866The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x befo
- CVE-2017-5867ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a d
- CVE-2015-2877Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest