CVEs published March 27, 2017
59 CVEs were published on March 27, 2017: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 59
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 58
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- Eview EV-07S GPS Tracker
- 3
- cherrymusic
- 2
- F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…
- 2
- IBM Kenexa LCMS Premier on Cloud
- 2
- IBM TRIRIGA Application Platform
- 2
- cryptography
- 1
- IBM Call Center for Commerce
- 1
- IBM Cognos Business Intelligence
- 1
- IBM Key Lifecycle Manager
- 1
- IBM WebSphere Portal
- 1
Critical 1
Medium, low and unrated 58
- CVE-2016-6056IBM Call Center for Commerce 9.3 and 9.4 is vulnerable to cross-site scripting.IBM Call Center for Commerce
- CVE-2016-6102IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters.IBM Key Lifecycle Manager
- CVE-2016-8960IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege uIBM Cognos Business Intelligence
- CVE-2016-9737IBM TRIRIGA 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting.IBM TRIRIGA Application Platform
- CVE-2017-1120IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting.IBM WebSphere Portal
- CVE-2017-1142IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set thIBM Kenexa LCMS Premier on Cloud
- CVE-2017-1143IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properIBM Kenexa LCMS Premier on Cloud
- CVE-2017-1153IBM TRIRIGA Report Manager 3.2 through 3.5 contains a vulnerability that could allow an authenticated user to execute actions that they do nIBM TRIRIGA Application Platform
- CVE-2017-5237Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a faEview EV-07S GPS Tracker
- CVE-2017-5238Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variaEview EV-07S GPS Tracker
- CVE-2017-5239Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the EvieEview EV-07S GPS Tracker
- CVE-2016-9252The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly hF5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…
- CVE-2017-7275The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memor
- CVE-2015-0863GALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps) before 14120405.03.012 allows man-in-the-middle attacker
- CVE-2015-0864Samsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in-the-middle attackers to obtain sensitive info
- CVE-2015-8010Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remo
- CVE-2015-8762The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and server
- CVE-2015-8763The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confir
- CVE-2015-8764Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow.
- CVE-2016-10225The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "roo
- CVE-2016-4912The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and
- CVE-2016-9243HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.cryptography
- CVE-2017-6451The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return va
- CVE-2017-6452Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified
- CVE-2017-6455NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environme
- CVE-2017-6458Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have
- CVE-2017-6459The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to a
- CVE-2017-6460Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspec
- CVE-2017-6462Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows lo
- CVE-2017-6463NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid set
- CVE-2017-6464NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configura
- CVE-2017-6542The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an a
- CVE-2017-7183The TFTP server in ExtraPuTTY 0.30 and earlier allows remote attackers to cause a denial of service (crash) via a large (1) read or (2) writ
- CVE-2017-7191The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitra
- CVE-2017-7271Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers toyiisoft/yii2
- CVE-2017-7272PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that
- CVE-2017-7273The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers
- CVE-2017-7274The r_pkcs7_parse_cms function in libr/util/r_pkcs7.c in radare2 1.3.0 allows remote attackers to cause a denial of service (NULL pointer de
- CVE-2015-8026Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a d
- CVE-2015-8309Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" pacherrymusic
- CVE-2015-8310Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or Hcherrymusic
- CVE-2016-7474In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, toF5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…
- CVE-2016-9922The cirrus_do_copy function in hw/display/cirrus_vga.c in QEMU (aka Quick Emulator), when cirrus graphics mode is VGA, allows local guest OS
- CVE-2017-5330ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated application
- CVE-2017-5850httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using a
- CVE-2017-5899Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to a
- CVE-2017-5931Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of servi
- CVE-2017-5932The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) ch
- CVE-2017-5973The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of s
- CVE-2017-6878Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the
- CVE-2017-6957Stack-based buffer overflow in the firmware in Broadcom Wi-Fi HardMAC SoC chips, when the firmware supports CCKM Fast and Secure Roaming and
- CVE-2017-6002Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/.
- CVE-2017-6003dotCMS 3.7.0 has XSS reachable from ext/languages_manager/edit_language in portal/layout via the bottom two form fields.
- CVE-2017-6013Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter.
- CVE-2017-6066Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/.
- CVE-2017-6067Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.
- CVE-2017-6068Subrion CMS 4.0.5 has CSRF in admin/blocks/add/.intelliants/subrion
- CVE-2017-6069Subrion CMS 4.0.5 has CSRF in admin/blog/add/.