CVEs published March 7, 2017
64 CVEs were published on March 7, 2017: 0 critical, 0 high.
- Published
- 64
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 63
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- IBM QRadar SIEM
- 10
- plone
- 6
- Apache Software Foundation Apache Camel · org.apache.camel:…
- 1
- F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…
- 1
- gethue
- 1
- IBM Business Process Manager Advanced
- 1
- IBM Maximo Asset Management
- 1
- IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7…
- 1
- IBM Tivoli Storage Manager
- 1
- IBM WebSphere MQ
- 1
Medium, low and unrated 64
- CVE-2017-2636Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service
- CVE-2016-10200Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a den
- CVE-2016-9245In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart.F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…
- CVE-2017-6511andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in app
- CVE-2017-5681The RSA-CRT implementation in the Intel QuickAssist Technology (QAT) Engine for OpenSSL versions prior to 0.5.19 may allow remote attackers Intel Quick Assist Technology
- CVE-2016-8940IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries.IBM Tivoli Storage Manager
- CVE-2016-8971IBM WebSphere MQ 8.0 could allow an authenticated user with queue manager permissions to cause a segmentation fault which would result in thIBM WebSphere MQ
- CVE-2016-9693IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks.IBM Business Process Manager Advanced
- CVE-2016-9720IBM QRadar 7.2 discloses sensitive information to unauthorized users.IBM QRadar SIEM
- CVE-2016-9723IBM QRadar 7.2 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2016-9724IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data.IBM QRadar SIEM
- CVE-2016-9725IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing (CORS), which is a mechanism that allows web sites to request resIBM QRadar SIEM
- CVE-2016-9726IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system.IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7…
- CVE-2016-9727IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system.IBM QRadar SIEM
- CVE-2016-9728IBM Qradar 7.2 is vulnerable to SQL injection.IBM QRadar SIEM
- CVE-2016-9729IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protecteIBM QRadar SIEM
- CVE-2016-9730IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoIBM QRadar SIEM
- CVE-2016-9740IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of reIBM QRadar SIEM
- CVE-2017-1124IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection.IBM Maximo Asset Management
- CVE-2017-1133IBM QRadar 7.2 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2016-4946Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script
- CVE-2016-4947Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.gethue
- CVE-2016-4948Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web scrip
- CVE-2016-4949Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the
- CVE-2016-4950Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions.
- CVE-2016-6239The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large s
- CVE-2016-6240Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileg
- CVE-2016-6241Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via
- CVE-2016-6242OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a kevent
- CVE-2016-6243thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in t
- CVE-2016-6245OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call.
- CVE-2016-6246OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpf
- CVE-2016-6247OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on
- CVE-2016-6255Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without
- CVE-2016-6350OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path start
- CVE-2016-6522Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel pan
- CVE-2016-7135Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary filplone
- CVE-2016-7136z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a cplone
- CVE-2016-7137Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers toplone
- CVE-2016-7138Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x thplone
- CVE-2016-7139Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x throuplone
- CVE-2016-7140Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x tplone
- CVE-2016-7780SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL command
- CVE-2016-7781SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attacke
- CVE-2016-7782SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbi
- CVE-2016-7783SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbi
- CVE-2016-7784SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows r
- CVE-2016-7788SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute
- CVE-2016-7789SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbi
- CVE-2016-8863Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows rem
- CVE-2016-9019SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent
- CVE-2016-9020SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attacke
- CVE-2016-9087SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allo
- CVE-2016-9643The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number
- CVE-2017-6509Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php (id parameter).
- CVE-2013-5653The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a
- CVE-2016-10040Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a x
- CVE-2016-5315The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read
- CVE-2016-6244The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via
- CVE-2016-7145The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequentl
- CVE-2016-9148Cross-site scripting (XSS) vulnerability in CA Service Desk Manager (formerly CA Service Desk) 12.9 and 14.1 allows remote attackers to inje
- CVE-2016-9164Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) 8.4 SP1 and earlier
- CVE-2017-3159Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability.Apache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2017-6508CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP head