# CVEs published 2017-03-27

59 CVEs were published on March 27, 2017: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-6056](https://cve.now/CVE-2016-6056.md): IBM Call Center for Commerce 9.3 and 9.4 is vulnerable to cross-site scripting. (no CVSS, IBM Call Center for Commerce)
- [CVE-2016-6102](https://cve.now/CVE-2016-6102.md): IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters. (no CVSS, IBM Key Lifecycle Manager)
- [CVE-2016-8960](https://cve.now/CVE-2016-8960.md): IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege u (no CVSS, IBM Cognos Business Intelligence)
- [CVE-2016-9737](https://cve.now/CVE-2016-9737.md): IBM TRIRIGA 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. (no CVSS, IBM TRIRIGA Application Platform)
- [CVE-2017-1120](https://cve.now/CVE-2017-1120.md): IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Portal)
- [CVE-2017-1142](https://cve.now/CVE-2017-1142.md): IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set th (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2017-1143](https://cve.now/CVE-2017-1143.md): IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to proper (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2017-1153](https://cve.now/CVE-2017-1153.md): IBM TRIRIGA Report Manager 3.2 through 3.5 contains a vulnerability that could allow an authenticated user to execute actions that they do n (no CVSS, IBM TRIRIGA Application Platform)
- [CVE-2017-5237](https://cve.now/CVE-2017-5237.md): Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a fa (no CVSS, Eview EV-07S GPS Tracker)
- [CVE-2017-5238](https://cve.now/CVE-2017-5238.md): Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one varia (no CVSS, Eview EV-07S GPS Tracker)
- [CVE-2017-5239](https://cve.now/CVE-2017-5239.md): Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Evie (no CVSS, Eview EV-07S GPS Tracker)
- [CVE-2016-9252](https://cve.now/CVE-2016-9252.md): The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly h (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…)
- [CVE-2017-7275](https://cve.now/CVE-2017-7275.md): The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memor (no CVSS)
- [CVE-2015-0863](https://cve.now/CVE-2015-0863.md): GALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps) before 14120405.03.012 allows man-in-the-middle attacker (no CVSS)
- [CVE-2015-0864](https://cve.now/CVE-2015-0864.md): Samsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in-the-middle attackers to obtain sensitive info (no CVSS)
- [CVE-2015-8010](https://cve.now/CVE-2015-8010.md): Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remo (no CVSS)
- [CVE-2015-8762](https://cve.now/CVE-2015-8762.md): The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and server (no CVSS)
- [CVE-2015-8763](https://cve.now/CVE-2015-8763.md): The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confir (no CVSS)
- [CVE-2015-8764](https://cve.now/CVE-2015-8764.md): Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow. (no CVSS)
- [CVE-2016-10225](https://cve.now/CVE-2016-10225.md): The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "roo (no CVSS)
- [CVE-2016-4912](https://cve.now/CVE-2016-4912.md): The \_xrealloc function in xlsp\_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and (no CVSS)
- [CVE-2016-9243](https://cve.now/CVE-2016-9243.md): HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest\_size. (no CVSS, cryptography)
- [CVE-2017-6451](https://cve.now/CVE-2017-6451.md): The mx4200\_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return va (no CVSS)
- [CVE-2017-6452](https://cve.now/CVE-2017-6452.md): Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified (no CVSS)
- [CVE-2017-6455](https://cve.now/CVE-2017-6455.md): NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI\_DLLS environme (no CVSS)
- [CVE-2017-6458](https://cve.now/CVE-2017-6458.md): Multiple buffer overflows in the ctl\_put\* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have (no CVSS)
- [CVE-2017-6459](https://cve.now/CVE-2017-6459.md): The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to a (no CVSS)
- [CVE-2017-6460](https://cve.now/CVE-2017-6460.md): Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspec (no CVSS)
- [CVE-2017-6462](https://cve.now/CVE-2017-6462.md): Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows lo (no CVSS)
- [CVE-2017-6463](https://cve.now/CVE-2017-6463.md): NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid set (no CVSS)
- [CVE-2017-6464](https://cve.now/CVE-2017-6464.md): NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configura (no CVSS)
- [CVE-2017-6542](https://cve.now/CVE-2017-6542.md): The ssh\_agent\_channel\_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an a (no CVSS)
- [CVE-2017-7183](https://cve.now/CVE-2017-7183.md): The TFTP server in ExtraPuTTY 0.30 and earlier allows remote attackers to cause a denial of service (crash) via a large (1) read or (2) writ (no CVSS)
- [CVE-2017-7191](https://cve.now/CVE-2017-7191.md): The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitra (no CVSS)
- [CVE-2017-7271](https://cve.now/CVE-2017-7271.md): Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to (no CVSS, yiisoft/yii2)
- [CVE-2017-7272](https://cve.now/CVE-2017-7272.md): PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that (no CVSS)
- [CVE-2017-7273](https://cve.now/CVE-2017-7273.md): The cp\_report\_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers (no CVSS)
- [CVE-2017-7274](https://cve.now/CVE-2017-7274.md): The r\_pkcs7\_parse\_cms function in libr/util/r\_pkcs7.c in radare2 1.3.0 allows remote attackers to cause a denial of service (NULL pointer de (no CVSS)
- [CVE-2015-8026](https://cve.now/CVE-2015-8026.md): Heap-based buffer overflow in the verify\_vbr\_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a d (no CVSS)
- [CVE-2015-8309](https://cve.now/CVE-2015-8309.md): Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" pa (no CVSS, cherrymusic)
- [CVE-2015-8310](https://cve.now/CVE-2015-8310.md): Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or H (no CVSS, cherrymusic)
- [CVE-2016-7474](https://cve.now/CVE-2016-7474.md): In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, to (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, D…)
- [CVE-2016-9922](https://cve.now/CVE-2016-9922.md): The cirrus\_do\_copy function in hw/display/cirrus\_vga.c in QEMU (aka Quick Emulator), when cirrus graphics mode is VGA, allows local guest OS (no CVSS)
- [CVE-2017-5330](https://cve.now/CVE-2017-5330.md): ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated application (no CVSS)
- [CVE-2017-5850](https://cve.now/CVE-2017-5850.md): httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using a (no CVSS)
- [CVE-2017-5899](https://cve.now/CVE-2017-5899.md): Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to a (no CVSS)
- [CVE-2017-5931](https://cve.now/CVE-2017-5931.md): Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of servi (no CVSS)
- [CVE-2017-5932](https://cve.now/CVE-2017-5932.md): The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) ch (no CVSS)
- [CVE-2017-5973](https://cve.now/CVE-2017-5973.md): The xhci\_kick\_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of s (no CVSS)
- [CVE-2017-6878](https://cve.now/CVE-2017-6878.md): Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2017-6957](https://cve.now/CVE-2017-6957.md): Stack-based buffer overflow in the firmware in Broadcom Wi-Fi HardMAC SoC chips, when the firmware supports CCKM Fast and Secure Roaming and (no CVSS)
- [CVE-2017-6002](https://cve.now/CVE-2017-6002.md): Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. (no CVSS)
- [CVE-2017-6003](https://cve.now/CVE-2017-6003.md): dotCMS 3.7.0 has XSS reachable from ext/languages\_manager/edit\_language in portal/layout via the bottom two form fields. (no CVSS)
- [CVE-2017-6013](https://cve.now/CVE-2017-6013.md): Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter. (no CVSS)
- [CVE-2017-6066](https://cve.now/CVE-2017-6066.md): Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. (no CVSS)
- [CVE-2017-6067](https://cve.now/CVE-2017-6067.md): Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field. (no CVSS)
- [CVE-2017-6068](https://cve.now/CVE-2017-6068.md): Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. (no CVSS, intelliants/subrion)
- [CVE-2017-6069](https://cve.now/CVE-2017-6069.md): Subrion CMS 4.0.5 has CSRF in admin/blog/add/. (no CVSS)
- [CVE-2017-7269](https://cve.now/CVE-2017-7269.md): Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows S (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.