# CVEs published 2017-03-22 29 CVEs were published on March 22, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-6972](https://cve.now/CVE-2017-6972.md): AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl co (no CVSS) - [CVE-2017-3851](https://cve.now/CVE-2017-3851.md): A Directory Traversal vulnerability in the web framework code of the Cisco application-hosting framework (CAF) component of the Cisco IOx ap (no CVSS, Cisco Application-Hosting Framework) - [CVE-2017-3852](https://cve.now/CVE-2017-3852.md): A vulnerability in the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an authentic (no CVSS, Cisco Application-Hosting Framework) - [CVE-2017-3853](https://cve.now/CVE-2017-3853.md): A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated, rem (no CVSS, Cisco IOx) - [CVE-2017-3856](https://cve.now/CVE-2017-3856.md): A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affec (no CVSS, Cisco IOS XE) - [CVE-2017-3857](https://cve.now/CVE-2017-3857.md): A vulnerability in the Layer 2 Tunneling Protocol (L2TP) parsing function of Cisco IOS (12.0 through 12.4 and 15.0 through 15.6) and Cisco I (no CVSS, Cisco IOS and IOS XE) - [CVE-2017-3858](https://cve.now/CVE-2017-3858.md): A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands tha (no CVSS, Cisco IOS XE) - [CVE-2017-3859](https://cve.now/CVE-2017-3859.md): A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an (no CVSS, Cisco IOS XE Software for Cisco ASR 920 Series Routers) - [CVE-2017-3864](https://cve.now/CVE-2017-3864.md): A vulnerability in the DHCP client implementation of Cisco IOS (12.2, 12.4, and 15.0 through 15.6) and Cisco IOS XE (3.3 through 3.7) could (no CVSS, Cisco IOS and IOS XE) - [CVE-2017-7230](https://cve.now/CVE-2017-7230.md): A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitrary code via a GET req (no CVSS) - [CVE-2017-7231](https://cve.now/CVE-2017-7231.md): pngdefry through 2017-03-22 is prone to a heap-based buffer-overflow vulnerability because it fails to properly process a specially crafted (no CVSS) - [CVE-2017-5673](https://cve.now/CVE-2017-5673.md): In the Kunena extension 5.0.2 through 5.0.4 for Joomla!, the forum message subject (aka topic subject) accepts JavaScript, leading to XSS. (no CVSS) - [CVE-2017-7223](https://cve.now/CVE-2017-7223.md): GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the (no CVSS) - [CVE-2017-7224](https://cve.now/CVE-2017-7224.md): The find\_nearest\_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt b (no CVSS) - [CVE-2017-7225](https://cve.now/CVE-2017-7225.md): The find\_nearest\_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name ar (no CVSS) - [CVE-2017-7226](https://cve.now/CVE-2017-7226.md): The pe\_ILF\_object\_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to (no CVSS) - [CVE-2017-7227](https://cve.now/CVE-2017-7227.md): GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while processing a bogus input script, leading to a progr (no CVSS) - [CVE-2014-9832](https://cve.now/CVE-2014-9832.md): Heap overflow in ImageMagick 6.8.9-9 via a crafted pcx file. (no CVSS) - [CVE-2014-9833](https://cve.now/CVE-2014-9833.md): Heap overflow in ImageMagick 6.8.9-9 via a crafted psd file. (no CVSS) - [CVE-2014-9834](https://cve.now/CVE-2014-9834.md): Heap overflow in ImageMagick 6.8.9-9 via a crafted pict file. (no CVSS) - [CVE-2014-9835](https://cve.now/CVE-2014-9835.md): Heap overflow in ImageMagick 6.8.9-9 via a crafted wpf file. (no CVSS) - [CVE-2014-9836](https://cve.now/CVE-2014-9836.md): ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service via a crafted xpm file. (no CVSS) - [CVE-2014-9838](https://cve.now/CVE-2014-9838.md): magick/cache.c in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (crash). (no CVSS) - [CVE-2014-9839](https://cve.now/CVE-2014-9839.md): magick/colormap-private.h in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access). (no CVSS) - [CVE-2014-9840](https://cve.now/CVE-2014-9840.md): ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted palm file. (no CVSS) - [CVE-2017-6970](https://cve.now/CVE-2017-6970.md): AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an (no CVSS) - [CVE-2017-6971](https://cve.now/CVE-2017-6971.md): AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged (no CVSS) - [CVE-2017-5874](https://cve.now/CVE-2017-5874.md): CSRF exists on D-Link DIR-600M Rev. (no CVSS) - [CVE-2017-7222](https://cve.now/CVE-2017-7222.md): A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if Manti (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-03-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.