# CVEs published 2017-03-20

63 CVEs were published on March 20, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-4926](https://cve.now/CVE-2016-4926.md): Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web inte (no CVSS)
- [CVE-2016-4927](https://cve.now/CVE-2016-4927.md): Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is com (no CVSS)
- [CVE-2016-4928](https://cve.now/CVE-2016-4928.md): Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on J (no CVSS)
- [CVE-2016-4929](https://cve.now/CVE-2016-4929.md): Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user. (no CVSS)
- [CVE-2016-4930](https://cve.now/CVE-2016-4930.md): Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform cert (no CVSS)
- [CVE-2016-4931](https://cve.now/CVE-2016-4931.md): XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. (no CVSS)
- [CVE-2016-6816](https://cve.now/CVE-2016-6816.md): The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the H (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2012-5361](https://cve.now/CVE-2012-5361.md): Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file. (no CVSS)
- [CVE-2014-9841](https://cve.now/CVE-2014-9841.md): The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, re (no CVSS)
- [CVE-2014-9842](https://cve.now/CVE-2014-9842.md): Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memor (no CVSS)
- [CVE-2014-9843](https://cve.now/CVE-2014-9843.md): The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors. (no CVSS)
- [CVE-2014-9844](https://cve.now/CVE-2014-9844.md): The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) v (no CVSS)
- [CVE-2014-9845](https://cve.now/CVE-2014-9845.md): The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib fi (no CVSS)
- [CVE-2014-9846](https://cve.now/CVE-2014-9846.md): Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact. (no CVSS)
- [CVE-2014-9847](https://cve.now/CVE-2014-9847.md): The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact. (no CVSS)
- [CVE-2014-9848](https://cve.now/CVE-2014-9848.md): Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption). (no CVSS)
- [CVE-2014-9849](https://cve.now/CVE-2014-9849.md): The png coder in ImageMagick allows remote attackers to cause a denial of service (crash). (no CVSS)
- [CVE-2014-9850](https://cve.now/CVE-2014-9850.md): Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption). (no CVSS)
- [CVE-2014-9851](https://cve.now/CVE-2014-9851.md): ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash). (no CVSS)
- [CVE-2015-1610](https://cve.now/CVE-2015-1610.md): hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topol (no CVSS)
- [CVE-2015-8954](https://cve.now/CVE-2015-8954.md): The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attacker (no CVSS)
- [CVE-2015-8983](https://cve.now/CVE-2015-8983.md): Integer overflow in the \_IO\_wstr\_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-d (no CVSS)
- [CVE-2015-8984](https://cve.now/CVE-2015-8984.md): The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of serv (no CVSS)
- [CVE-2015-8985](https://cve.now/CVE-2015-8985.md): The pop\_fail\_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (asser (no CVSS)
- [CVE-2016-10214](https://cve.now/CVE-2016-10214.md): Memory leak in the virgl\_resource\_attach\_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of ser (no CVSS)
- [CVE-2016-2406](https://cve.now/CVE-2016-2406.md): The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to (no CVSS)
- [CVE-2016-2981](https://cve.now/CVE-2016-2981.md): An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-5857](https://cve.now/CVE-2016-5857.md): The Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code within the context of the kernel via a crafted (no CVSS)
- [CVE-2016-8973](https://cve.now/CVE-2016-8973.md): IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious fil (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2016-9165](https://cve.now/CVE-2016-9165.md): The get\_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Mana (no CVSS)
- [CVE-2016-9694](https://cve.now/CVE-2016-9694.md): IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2016-9696](https://cve.now/CVE-2016-9696.md): IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to HTML injection. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2016-9697](https://cve.now/CVE-2016-9697.md): An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. (no CVSS, IBM Rational Rhapsody Design Manager)
- [CVE-2017-1134](https://cve.now/CVE-2017-1134.md): IBM Reliable Scalable Cluster Technology could allow a local user to escalate their privileges to gain root access. (no CVSS, IBM Tivoli System Automation for Multiplatforms)
- [CVE-2017-1145](https://cve.now/CVE-2017-1145.md): IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a deni (no CVSS, IBM WebSphere MQ)
- [CVE-2017-1146](https://cve.now/CVE-2017-1146.md): IBM Content Navigator 2.0.3 and 3.0.0 are vulnerable to cross-site scripting. (no CVSS, IBM Content Navigator)
- [CVE-2017-1151](https://cve.now/CVE-2017-1151.md): IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) (no CVSS, IBM WebSphere Application Server)
- [CVE-2017-1155](https://cve.now/CVE-2017-1155.md): IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to another user's reports using a special (no CVSS, IBM Algo One)
- [CVE-2017-5618](https://cve.now/CVE-2017-5618.md): GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking o (no CVSS)
- [CVE-2017-5930](https://cve.now/CVE-2017-5930.md): The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete (no CVSS)
- [CVE-2017-5956](https://cve.now/CVE-2017-5956.md): The vrend\_draw\_vbo function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array acce (no CVSS)
- [CVE-2017-5987](https://cve.now/CVE-2017-5987.md): The sdhci\_sdma\_transfer\_multi\_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause (no CVSS)
- [CVE-2017-6058](https://cve.now/CVE-2017-6058.md): Buffer overflow in NetRxPkt::ehdr\_buf in hw/net/net\_rx\_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxn (no CVSS)
- [CVE-2017-6178](https://cve.now/CVE-2017-6178.md): The IofCallDriver function in USBPcap 1.1.0.0 allows local users to gain privileges via a crafted 0x00090028 IOCTL call, which triggers a NU (no CVSS)
- [CVE-2017-6318](https://cve.now/CVE-2017-6318.md): saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE\_NET\_CONTROL\_OPTION packet. (no CVSS)
- [CVE-2017-6356](https://cve.now/CVE-2017-6356.md): Palo Alto Networks Terminal Services (aka TS) Agent 6.0, 7.0, and 8.0 before 8.0.1 uses weak permissions for unspecified resources, which al (no CVSS)
- [CVE-2017-6550](https://cve.now/CVE-2017-6550.md): Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2017-6803](https://cve.now/CVE-2017-6803.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP Voyager (no CVSS)
- [CVE-2017-6805](https://cve.now/CVE-2017-6805.md): Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a (no CVSS)
- [CVE-2017-6829](https://cve.now/CVE-2017-6829.md): The decodeSample function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash (no CVSS)
- [CVE-2017-6830](https://cve.now/CVE-2017-6830.md): Heap-based buffer overflow in the alaw2linear\_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers t (no CVSS)
- [CVE-2017-6831](https://cve.now/CVE-2017-6831.md): Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3. (no CVSS)
- [CVE-2017-6832](https://cve.now/CVE-2017-6832.md): Heap-based buffer overflow in the decodeBlock in MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, (no CVSS)
- [CVE-2017-6833](https://cve.now/CVE-2017-6833.md): The runPull function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-6834](https://cve.now/CVE-2017-6834.md): Heap-based buffer overflow in the ulaw2linear\_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3 (no CVSS)
- [CVE-2017-6835](https://cve.now/CVE-2017-6835.md): The reset1 function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a de (no CVSS)
- [CVE-2017-6836](https://cve.now/CVE-2017-6836.md): Heap-based buffer overflow in the Expand3To4Module::run function in libaudiofile/modules/SimpleModule.h in Audio File Library (aka audiofile (no CVSS)
- [CVE-2017-6837](https://cve.now/CVE-2017-6837.md): WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a l (no CVSS)
- [CVE-2017-6838](https://cve.now/CVE-2017-6838.md): Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2017-6839](https://cve.now/CVE-2017-6839.md): Integer overflow in modules/MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (cr (no CVSS)
- [CVE-2017-7187](https://cve.now/CVE-2017-7187.md): The sg\_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based b (no CVSS)
- [CVE-2014-9938](https://cve.now/CVE-2014-9938.md): contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to (no CVSS)
- [CVE-2017-7186](https://cve.now/CVE-2017-7186.md): libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read acces (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.