# CVEs published 2017-03-03

50 CVEs were published on March 3, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-10070](https://cve.now/CVE-2016-10070.md): Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denia (no CVSS)
- [CVE-2016-3127](https://cve.now/CVE-2016-3127.md): An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allo (no CVSS, BlackBerry Good Control Server versions earlier than)
- [CVE-2016-8236](https://cve.now/CVE-2016-8236.md): Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM ve (no CVSS, Lenovo Group ThinkServer RD350, RD450, RD550, RD650, TD350)
- [CVE-2016-10061](https://cve.now/CVE-2016-10061.md): The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which al (no CVSS)
- [CVE-2016-10065](https://cve.now/CVE-2016-10065.md): The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application (no CVSS)
- [CVE-2016-10066](https://cve.now/CVE-2016-10066.md): Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2015-8813](https://cve.now/CVE-2015-8813.md): The Page\_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attacke (no CVSS, Umbraco.CMS)
- [CVE-2015-8814](https://cve.now/CVE-2015-8814.md): Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks (no CVSS, Umbraco.CMS)
- [CVE-2015-8815](https://cve.now/CVE-2015-8815.md): Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2016-6882](https://cve.now/CVE-2016-6882.md): MatrixSSL before 3.8.7, when the DHE\_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key inf (no CVSS)
- [CVE-2016-6883](https://cve.now/CVE-2016-6883.md): MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher varian (no CVSS)
- [CVE-2016-6884](https://cve.now/CVE-2016-6884.md): TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial of service (out-of-bou (no CVSS)
- [CVE-2016-7406](https://cve.now/CVE-2016-7406.md): Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in (no CVSS)
- [CVE-2016-7407](https://cve.now/CVE-2016-7407.md): The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file. (no CVSS)
- [CVE-2016-7408](https://cve.now/CVE-2016-7408.md): The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument. (no CVSS)
- [CVE-2016-7409](https://cve.now/CVE-2016-7409.md): The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG\_TRACE, allows local users to read process memory via the -v (no CVSS)
- [CVE-2016-7969](https://cve.now/CVE-2016-7969.md): The wrap\_lines\_smart function in ass\_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds re (no CVSS)
- [CVE-2016-7970](https://cve.now/CVE-2016-7970.md): Buffer overflow in the calc\_coeff function in libass/ass\_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2016-7972](https://cve.now/CVE-2016-7972.md): The check\_allocations function in libass/ass\_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory a (no CVSS)
- [CVE-2016-10127](https://cve.now/CVE-2016-10127.md): PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response. (no CVSS, pysaml2)
- [CVE-2016-10193](https://cve.now/CVE-2016-10193.md): The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (no CVSS, espeak-ruby)
- [CVE-2016-10194](https://cve.now/CVE-2016-10194.md): The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to\_spee (no CVSS, festivaltts4r)
- [CVE-2016-10201](https://cve.now/CVE-2016-10201.md): Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2016-10202](https://cve.now/CVE-2016-10202.md): Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2016-10203](https://cve.now/CVE-2016-10203.md): Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2016-10204](https://cve.now/CVE-2016-10204.md): SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter (no CVSS)
- [CVE-2016-10205](https://cve.now/CVE-2016-10205.md): Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie. (no CVSS)
- [CVE-2016-10206](https://cve.now/CVE-2016-10206.md): Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users (no CVSS)
- [CVE-2017-2290](https://cve.now/CVE-2017-2290.md): On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will (no CVSS, mcollective-puppet-agent plugin)
- [CVE-2017-5193](https://cve.now/CVE-2017-5193.md): The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a (no CVSS)
- [CVE-2017-5194](https://cve.now/CVE-2017-5194.md): Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an invalid nick message (no CVSS)
- [CVE-2017-5195](https://cve.now/CVE-2017-5195.md): Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color c (no CVSS)
- [CVE-2017-5196](https://cve.now/CVE-2017-5196.md): Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings (no CVSS)
- [CVE-2017-5356](https://cve.now/CVE-2017-5356.md): Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting (no CVSS)
- [CVE-2017-5571](https://cve.now/CVE-2017-5571.md): Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in (no CVSS)
- [CVE-2017-5613](https://cve.now/CVE-2017-5613.md): Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a temp (no CVSS)
- [CVE-2017-5614](https://cve.now/CVE-2017-5614.md): Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing at (no CVSS)
- [CVE-2017-5615](https://cve.now/CVE-2017-5615.md): cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location. (no CVSS)
- [CVE-2017-5616](https://cve.now/CVE-2017-5616.md): Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the adde (no CVSS)
- [CVE-2017-5830](https://cve.now/CVE-2017-5830.md): Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery sc (no CVSS)
- [CVE-2017-5831](https://cve.now/CVE-2017-5831.md): Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote (no CVSS)
- [CVE-2017-5832](https://cve.now/CVE-2017-5832.md): Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or (no CVSS)
- [CVE-2017-5833](https://cve.now/CVE-2017-5833.md): Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows rem (no CVSS)
- [CVE-2017-5834](https://cve.now/CVE-2017-5834.md): The parse\_dict\_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a (no CVSS)
- [CVE-2017-5835](https://cve.now/CVE-2017-5835.md): libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. (no CVSS)
- [CVE-2017-5836](https://cve.now/CVE-2017-5836.md): The plist\_free\_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer n (no CVSS)
- [CVE-2017-5865](https://cve.now/CVE-2017-5865.md): The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends diff (no CVSS)
- [CVE-2017-5866](https://cve.now/CVE-2017-5866.md): The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x befo (no CVSS)
- [CVE-2017-5867](https://cve.now/CVE-2017-5867.md): ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a d (no CVSS)
- [CVE-2015-2877](https://cve.now/CVE-2015-2877.md): Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.