# CVEs published 2017-03-07

64 CVEs were published on March 7, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-2636](https://cve.now/CVE-2017-2636.md): Race condition in drivers/tty/n\_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (no CVSS)
- [CVE-2016-10200](https://cve.now/CVE-2016-10200.md): Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a den (no CVSS)
- [CVE-2016-9245](https://cve.now/CVE-2016-9245.md): In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…)
- [CVE-2017-6511](https://cve.now/CVE-2017-6511.md): andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in app (CVSS 6.1)
- [CVE-2017-5681](https://cve.now/CVE-2017-5681.md): The RSA-CRT implementation in the Intel QuickAssist Technology (QAT) Engine for OpenSSL versions prior to 0.5.19 may allow remote attackers (no CVSS, Intel Quick Assist Technology)
- [CVE-2016-8940](https://cve.now/CVE-2016-8940.md): IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. (no CVSS, IBM Tivoli Storage Manager)
- [CVE-2016-8971](https://cve.now/CVE-2016-8971.md): IBM WebSphere MQ 8.0 could allow an authenticated user with queue manager permissions to cause a segmentation fault which would result in th (no CVSS, IBM WebSphere MQ)
- [CVE-2016-9693](https://cve.now/CVE-2016-9693.md): IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. (no CVSS, IBM Business Process Manager Advanced)
- [CVE-2016-9720](https://cve.now/CVE-2016-9720.md): IBM QRadar 7.2 discloses sensitive information to unauthorized users. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9723](https://cve.now/CVE-2016-9723.md): IBM QRadar 7.2 is vulnerable to cross-site scripting. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9724](https://cve.now/CVE-2016-9724.md): IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9725](https://cve.now/CVE-2016-9725.md): IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing (CORS), which is a mechanism that allows web sites to request res (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9726](https://cve.now/CVE-2016-9726.md): IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. (no CVSS, IBM Security QRadar SIEM 7.1 MR1, 7.1, 7.0, 7.2, 7.1 MR2, 7…)
- [CVE-2016-9727](https://cve.now/CVE-2016-9727.md): IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9728](https://cve.now/CVE-2016-9728.md): IBM Qradar 7.2 is vulnerable to SQL injection. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9729](https://cve.now/CVE-2016-9729.md): IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protecte (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9730](https://cve.now/CVE-2016-9730.md): IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unautho (no CVSS, IBM QRadar SIEM)
- [CVE-2016-9740](https://cve.now/CVE-2016-9740.md): IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of re (no CVSS, IBM QRadar SIEM)
- [CVE-2017-1124](https://cve.now/CVE-2017-1124.md): IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. (no CVSS, IBM Maximo Asset Management)
- [CVE-2017-1133](https://cve.now/CVE-2017-1133.md): IBM QRadar 7.2 is vulnerable to cross-site scripting. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-4946](https://cve.now/CVE-2016-4946.md): Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2016-4947](https://cve.now/CVE-2016-4947.md): Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete. (no CVSS, gethue)
- [CVE-2016-4948](https://cve.now/CVE-2016-4948.md): Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2016-4949](https://cve.now/CVE-2016-4949.md): Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the (no CVSS)
- [CVE-2016-4950](https://cve.now/CVE-2016-4950.md): Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions. (no CVSS)
- [CVE-2016-6239](https://cve.now/CVE-2016-6239.md): The mmap extension \_\_MAP\_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large s (no CVSS)
- [CVE-2016-6240](https://cve.now/CVE-2016-6240.md): Integer truncation error in the amap\_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileg (no CVSS)
- [CVE-2016-6241](https://cve.now/CVE-2016-6241.md): Integer overflow in the amap\_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via (no CVSS)
- [CVE-2016-6242](https://cve.now/CVE-2016-6242.md): OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a kevent (no CVSS)
- [CVE-2016-6243](https://cve.now/CVE-2016-6243.md): thrsleep in kern/kern\_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in t (no CVSS)
- [CVE-2016-6245](https://cve.now/CVE-2016-6245.md): OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call. (no CVSS)
- [CVE-2016-6246](https://cve.now/CVE-2016-6246.md): OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpf (no CVSS)
- [CVE-2016-6247](https://cve.now/CVE-2016-6247.md): OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on (no CVSS)
- [CVE-2016-6255](https://cve.now/CVE-2016-6255.md): Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without (no CVSS)
- [CVE-2016-6350](https://cve.now/CVE-2016-6350.md): OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path start (no CVSS)
- [CVE-2016-6522](https://cve.now/CVE-2016-6522.md): Integer overflow in the uvm\_map\_isavail function in uvm/uvm\_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel pan (no CVSS)
- [CVE-2016-7135](https://cve.now/CVE-2016-7135.md): Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary fil (no CVSS, plone)
- [CVE-2016-7136](https://cve.now/CVE-2016-7136.md): z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a c (no CVSS, plone)
- [CVE-2016-7137](https://cve.now/CVE-2016-7137.md): Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to (no CVSS, plone)
- [CVE-2016-7138](https://cve.now/CVE-2016-7138.md): Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x th (no CVSS, plone)
- [CVE-2016-7139](https://cve.now/CVE-2016-7139.md): Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x throu (no CVSS, plone)
- [CVE-2016-7140](https://cve.now/CVE-2016-7140.md): Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x t (no CVSS, plone)
- [CVE-2016-7780](https://cve.now/CVE-2016-7780.md): SQL injection vulnerability in cron/find\_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2016-7781](https://cve.now/CVE-2016-7781.md): SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attacke (no CVSS)
- [CVE-2016-7782](https://cve.now/CVE-2016-7782.md): SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbi (no CVSS)
- [CVE-2016-7783](https://cve.now/CVE-2016-7783.md): SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbi (no CVSS)
- [CVE-2016-7784](https://cve.now/CVE-2016-7784.md): SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows r (no CVSS)
- [CVE-2016-7788](https://cve.now/CVE-2016-7788.md): SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute (no CVSS)
- [CVE-2016-7789](https://cve.now/CVE-2016-7789.md): SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbi (no CVSS)
- [CVE-2016-8863](https://cve.now/CVE-2016-8863.md): Heap-based buffer overflow in the create\_url\_list function in gena/gena\_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows rem (no CVSS)
- [CVE-2016-9019](https://cve.now/CVE-2016-9019.md): SQL injection vulnerability in the activate\_address function in framework/modules/addressbook/controllers/addressController.php in Exponent (no CVSS)
- [CVE-2016-9020](https://cve.now/CVE-2016-9020.md): SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attacke (no CVSS)
- [CVE-2016-9087](https://cve.now/CVE-2016-9087.md): SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allo (no CVSS)
- [CVE-2016-9643](https://cve.now/CVE-2016-9643.md): The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number (no CVSS)
- [CVE-2017-6509](https://cve.now/CVE-2017-6509.md): Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php (id parameter). (no CVSS)
- [CVE-2013-5653](https://cve.now/CVE-2013-5653.md): The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a (no CVSS)
- [CVE-2016-10040](https://cve.now/CVE-2016-10040.md): Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a x (no CVSS)
- [CVE-2016-5315](https://cve.now/CVE-2016-5315.md): The setByteArray function in tif\_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read (no CVSS)
- [CVE-2016-6244](https://cve.now/CVE-2016-6244.md): The sys\_thrsigdivert function in kern/kern\_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via (no CVSS)
- [CVE-2016-7145](https://cve.now/CVE-2016-7145.md): The m\_authenticate function in ircd/m\_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequentl (no CVSS)
- [CVE-2016-9148](https://cve.now/CVE-2016-9148.md): Cross-site scripting (XSS) vulnerability in CA Service Desk Manager (formerly CA Service Desk) 12.9 and 14.1 allows remote attackers to inje (no CVSS)
- [CVE-2016-9164](https://cve.now/CVE-2016-9164.md): Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) 8.4 SP1 and earlier (no CVSS)
- [CVE-2017-3159](https://cve.now/CVE-2017-3159.md): Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. (no CVSS, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2017-6508](https://cve.now/CVE-2017-6508.md): CRLF injection vulnerability in the url\_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP head (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.