# CVEs published 2017-03-23

105 CVEs were published on March 23, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-7247](https://cve.now/CVE-2017-7247.md): Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. (no CVSS)
- [CVE-2017-7248](https://cve.now/CVE-2017-7248.md): A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. (no CVSS)
- [CVE-2017-7249](https://cve.now/CVE-2017-7249.md): Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. (no CVSS)
- [CVE-2017-7250](https://cve.now/CVE-2017-7250.md): A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. (no CVSS)
- [CVE-2017-7251](https://cve.now/CVE-2017-7251.md): A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. (no CVSS, pi/pi)
- [CVE-2017-7244](https://cve.now/CVE-2017-7244.md): The \_pcre32\_xclass function in pcre\_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory r (no CVSS)
- [CVE-2017-7245](https://cve.now/CVE-2017-7245.md): Stack-based buffer overflow in the pcre32\_copy\_substring function in pcre\_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a (no CVSS)
- [CVE-2017-7246](https://cve.now/CVE-2017-7246.md): Stack-based buffer overflow in the pcre32\_copy\_substring function in pcre\_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a (no CVSS)
- [CVE-2013-6446](https://cve.now/CVE-2013-6446.md): The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows re (no CVSS)
- [CVE-2014-0229](https://cve.now/CVE-2014-0229.md): Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) (no CVSS, org.apache.hadoop:hadoop-common)
- [CVE-2015-0855](https://cve.now/CVE-2015-0855.md): The \_mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters (no CVSS)
- [CVE-2015-2263](https://cve.now/CVE-2015-2263.md): Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for fi (no CVSS)
- [CVE-2015-4078](https://cve.now/CVE-2015-4078.md): Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier (no CVSS)
- [CVE-2015-4166](https://cve.now/CVE-2015-4166.md): Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vecto (no CVSS)
- [CVE-2015-5729](https://cve.now/CVE-2015-5729.md): The Soft Access Point (AP) feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK (no CVSS)
- [CVE-2015-8622](https://cve.now/CVE-2015-8622.md): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, (no CVSS)
- [CVE-2015-8623](https://cve.now/CVE-2015-8623.md): The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token compariso (no CVSS)
- [CVE-2015-8624](https://cve.now/CVE-2015-8624.md): The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x b (no CVSS)
- [CVE-2015-8625](https://cve.now/CVE-2015-8625.md): MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when call (no CVSS)
- [CVE-2015-8626](https://cve.now/CVE-2015-8626.md): The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generate (no CVSS)
- [CVE-2015-8627](https://cve.now/CVE-2015-8627.md): MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses contai (no CVSS)
- [CVE-2015-8628](https://cve.now/CVE-2015-8628.md): The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaW (no CVSS)
- [CVE-2015-8687](https://cve.now/CVE-2015-8687.md): Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 (no CVSS)
- [CVE-2017-6517](https://cve.now/CVE-2017-6517.md): Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the ta (no CVSS)
- [CVE-2017-6895](https://cve.now/CVE-2017-6895.md): USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml. (no CVSS)
- [CVE-2017-6911](https://cve.now/CVE-2017-6911.md): USB Pratirodh is prone to sensitive information disclosure. (no CVSS)
- [CVE-2017-6950](https://cve.now/CVE-2017-6950.md): SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy restrictions and execute arbitrary code via a crafted ABA (no CVSS)
- [CVE-2017-7242](https://cve.now/CVE-2017-7242.md): Multiple Cross-Site Scripting (XSS) were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords paramete (no CVSS)
- [CVE-2016-8885](https://cve.now/CVE-2016-8885.md): The bmp\_getdata function in libjasper/bmp/bmp\_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL poin (no CVSS)
- [CVE-2016-8886](https://cve.now/CVE-2016-8886.md): The jas\_malloc function in libjasper/base/jas\_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a cr (no CVSS)
- [CVE-2016-8887](https://cve.now/CVE-2016-8887.md): The jp2\_colr\_destroy function in libjasper/jp2/jp2\_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NUL (no CVSS)
- [CVE-2016-9011](https://cve.now/CVE-2016-9011.md): The wmf\_malloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wm (no CVSS)
- [CVE-2016-9262](https://cve.now/CVE-2016-9262.md): Multiple integer overflows in the (1) jas\_realloc function in base/jas\_malloc.c and (2) mem\_resize function in base/jas\_stream.c in JasPer b (no CVSS)
- [CVE-2016-9264](https://cve.now/CVE-2016-9264.md): Buffer overflow in the printMP3Headers function in listmp3.c in Libming 0.4.7 allows remote attackers to cause a denial of service (out-of-b (no CVSS)
- [CVE-2016-9265](https://cve.now/CVE-2016-9265.md): The printMP3Headers function in listmp3.c in Libming 0.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and ap (no CVSS)
- [CVE-2016-9266](https://cve.now/CVE-2016-9266.md): listmp3.c in libming 0.4.7 allows remote attackers to unspecified impact via a crafted mp3 file, which triggers an invalid left shift. (no CVSS)
- [CVE-2016-9275](https://cve.now/CVE-2016-9275.md): Heap-based buffer overflow in the \_dwarf\_skim\_forms function in libdwarf/dwarf\_macro5.c in Libdwarf before 20161124 allows remote attackers (no CVSS)
- [CVE-2016-9276](https://cve.now/CVE-2016-9276.md): The dwarf\_get\_aranges\_list function in dwarf\_arrange.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out (no CVSS)
- [CVE-2016-9387](https://cve.now/CVE-2016-9387.md): Integer overflow in the jpc\_dec\_process\_siz function in libjasper/jpc/jpc\_dec.c in JasPer before 1.900.13 allows remote attackers to have un (no CVSS)
- [CVE-2016-9388](https://cve.now/CVE-2016-9388.md): The ras\_getcmap function in ras\_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via (no CVSS)
- [CVE-2016-9389](https://cve.now/CVE-2016-9389.md): The jpc\_irct and jpc\_iict functions in jpc\_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion fa (no CVSS)
- [CVE-2016-9390](https://cve.now/CVE-2016-9390.md): The jas\_seq2d\_create function in jas\_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure (no CVSS)
- [CVE-2016-9391](https://cve.now/CVE-2016-9391.md): The jpc\_bitstream\_getbits function in jpc\_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failu (no CVSS)
- [CVE-2016-9392](https://cve.now/CVE-2016-9392.md): The calcstepsizes function in jpc\_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) v (no CVSS)
- [CVE-2016-9393](https://cve.now/CVE-2016-9393.md): The jpc\_pi\_nextrpcl function in jpc\_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failur (no CVSS)
- [CVE-2016-9394](https://cve.now/CVE-2016-9394.md): The jas\_seq2d\_create function in jas\_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure (no CVSS)
- [CVE-2016-9395](https://cve.now/CVE-2016-9395.md): The jas\_seq2d\_create function in jas\_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure (no CVSS)
- [CVE-2016-9396](https://cve.now/CVE-2016-9396.md): The JPC\_NOMINALGAIN function in jpc/jpc\_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC\_COX\_RFT a (no CVSS)
- [CVE-2016-9397](https://cve.now/CVE-2016-9397.md): The jpc\_dequantize function in jpc\_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via uns (no CVSS)
- [CVE-2016-9398](https://cve.now/CVE-2016-9398.md): The jpc\_floorlog2 function in jpc\_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) (no CVSS)
- [CVE-2016-9399](https://cve.now/CVE-2016-9399.md): The calcstepsizes function in jpc\_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unsp (no CVSS)
- [CVE-2016-9556](https://cve.now/CVE-2016-9556.md): The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of- (no CVSS)
- [CVE-2016-9557](https://cve.now/CVE-2016-9557.md): Integer overflow in jas\_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a cra (no CVSS)
- [CVE-2014-7279](https://cve.now/CVE-2014-7279.md): The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "equipment management a (no CVSS)
- [CVE-2014-8731](https://cve.now/CVE-2014-8731.md): PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last (no CVSS)
- [CVE-2014-9915](https://cve.now/CVE-2014-9915.md): Off-by-one error in ImageMagick before 6.6.0-4 allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM p (no CVSS)
- [CVE-2016-10046](https://cve.now/CVE-2016-10046.md): Heap-based buffer overflow in the DrawImage function in magick/draw.c in ImageMagick before 6.9.5-5 allows remote attackers to cause a denia (no CVSS)
- [CVE-2016-10047](https://cve.now/CVE-2016-10047.md): Memory leak in the NewXMLTree function in magick/xml-tree.c in ImageMagick before 6.9.4-7 allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2016-10048](https://cve.now/CVE-2016-10048.md): Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecifie (no CVSS)
- [CVE-2016-10049](https://cve.now/CVE-2016-10049.md): Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2016-10050](https://cve.now/CVE-2016-10050.md): Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2016-10051](https://cve.now/CVE-2016-10051.md): Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2016-10052](https://cve.now/CVE-2016-10052.md): Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2016-10053](https://cve.now/CVE-2016-10053.md): The WriteTIFFImage function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (divide-by-z (no CVSS)
- [CVE-2016-10054](https://cve.now/CVE-2016-10054.md): Buffer overflow in the WriteMAPImage function in coders/map.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2016-10055](https://cve.now/CVE-2016-10055.md): Buffer overflow in the WritePDBImage function in coders/pdb.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2016-10056](https://cve.now/CVE-2016-10056.md): Buffer overflow in the sixel\_decode function in coders/sixel.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2016-10057](https://cve.now/CVE-2016-10057.md): Buffer overflow in the WriteGROUP4Image function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2016-10058](https://cve.now/CVE-2016-10058.md): Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2016-10059](https://cve.now/CVE-2016-10059.md): Buffer overflow in coders/tiff.c in ImageMagick before 6.9.4-1 allows remote attackers to cause a denial of service (application crash) or h (no CVSS)
- [CVE-2016-10254](https://cve.now/CVE-2016-10254.md): The allocate\_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted EL (no CVSS)
- [CVE-2016-10255](https://cve.now/CVE-2016-10255.md): The \_\_libelf\_set\_rawdata\_wrlock function in elf\_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (cra (no CVSS)
- [CVE-2016-6225](https://cve.now/CVE-2016-6225.md): xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which (no CVSS)
- [CVE-2016-9774](https://cve.now/CVE-2016-9774.md): The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on (no CVSS)
- [CVE-2016-9775](https://cve.now/CVE-2016-9775.md): The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before (no CVSS)
- [CVE-2017-5206](https://cve.now/CVE-2017-5206.md): Firejail before 0.9.44.4, when running on a Linux kernel before 4.8, allows context-dependent attackers to bypass a seccomp-based sandbox pr (no CVSS)
- [CVE-2017-5207](https://cve.now/CVE-2017-5207.md): Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument. (no CVSS)
- [CVE-2017-5227](https://cve.now/CVE-2017-5227.md): QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an (no CVSS)
- [CVE-2017-5524](https://cve.now/CVE-2017-5524.md): Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive informat (no CVSS, plone)
- [CVE-2017-5538](https://cve.now/CVE-2017-5538.md): The kbase\_dispatch function in arm/t7xx/r5p0/mali\_kbase\_core\_linux.c in the GPU driver on Samsung devices with M(6.0) and N(7.0) software an (no CVSS)
- [CVE-2017-5897](https://cve.now/CVE-2017-5897.md): The ip6gre\_err function in net/ipv6/ip6\_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving G (no CVSS)
- [CVE-2017-6191](https://cve.now/CVE-2017-6191.md): Buffer overflow in APNGDis 2.8 and below allows a remote attacker to execute arbitrary code via a crafted filename. (no CVSS)
- [CVE-2017-6359](https://cve.now/CVE-2017-6359.md): QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vector (no CVSS)
- [CVE-2017-6360](https://cve.now/CVE-2017-6360.md): QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vect (no CVSS)
- [CVE-2017-6361](https://cve.now/CVE-2017-6361.md): QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. (no CVSS)
- [CVE-2017-7199](https://cve.now/CVE-2017-7199.md): Nessus 6.6.2 - 6.10.3 contains a flaw related to insecure permissions that may allow a local attacker to escalate privileges when the softwa (no CVSS)
- [CVE-2016-7468](https://cve.now/CVE-2016-7468.md): An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network tra (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, L…)
- [CVE-2016-1597](https://cve.now/CVE-2016-1597.md): A logged-in user in NetIQ Access Governance Suite 6.0 through 6.4 could escalate privileges to administrator. (no CVSS, Access Governance Suite)
- [CVE-2016-1602](https://cve.now/CVE-2016-1602.md): A code injection in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Ente (no CVSS, supportconfig)
- [CVE-2016-1603](https://cve.now/CVE-2016-1603.md): An information leak in the NetIQ IDM ServiceNow Driver before 1.0.0.1 could expose cryptographic attributes to logged-in users. (no CVSS, NetIQ IDM ServiceNow)
- [CVE-2016-5747](https://cve.now/CVE-2016-5747.md): A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attacke (no CVSS, Novell eDirectory)
- [CVE-2016-5748](https://cve.now/CVE-2016-5748.md): External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 be (no CVSS, NetIQ Access Manager)
- [CVE-2016-5749](https://cve.now/CVE-2016-5749.md): NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, (no CVSS, NetIQ Access Manager)
- [CVE-2016-5750](https://cve.now/CVE-2016-5750.md): The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload J (no CVSS, NetIQ iManager)
- [CVE-2016-5751](https://cve.now/CVE-2016-5751.md): An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 be (no CVSS, NetIQ Access Manager)
- [CVE-2016-5752](https://cve.now/CVE-2016-5752.md): The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML req (no CVSS, NetIQ Access Manager)
- [CVE-2016-5754](https://cve.now/CVE-2016-5754.md): Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2. (no CVSS, NetIQ Access Manager)
- [CVE-2016-5755](https://cve.now/CVE-2016-5755.md): NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filt (no CVSS, NetIQ Access Manager)
- [CVE-2016-5756](https://cve.now/CVE-2016-5756.md): Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cr (no CVSS, NetIQ Access Manager)
- [CVE-2016-5757](https://cve.now/CVE-2016-5757.md): iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks (no CVSS, NetIQ Access Manager)
- [CVE-2016-5758](https://cve.now/CVE-2016-5758.md): A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumven (no CVSS, NetIQ Access Manager)
- [CVE-2016-9167](https://cve.now/CVE-2016-9167.md): NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a p (no CVSS, Novell eDirectory)
- [CVE-2016-9168](https://cve.now/CVE-2016-9168.md): A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for (no CVSS, Novell eDirectory)
- [CVE-2016-9169](https://cve.now/CVE-2016-9169.md): A reflected XSS vulnerability exists in the web console of the Document Viewer Agent in Novell GroupWise before 2014 R2 Support Pack 1 Hot P (no CVSS, Novell GroupWise)
- [CVE-2017-7235](https://cve.now/CVE-2017-7235.md): An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. (no CVSS, cfscrape)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.