# CVEs published 2017-03-28

39 CVEs were published on March 28, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-6807](https://cve.now/CVE-2016-6807.md): Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operati (no CVSS, Apache Software Foundation Apache Ambari · org.apache.ambar…)
- [CVE-2016-8749](https://cve.now/CVE-2016-8749.md): Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. (no CVSS, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2014-6440](https://cve.now/CVE-2014-6440.md): VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service. (no CVSS)
- [CVE-2016-8031](https://cve.now/CVE-2016-8031.md): Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local users to bypass local secu (no CVSS, Intel Anti-Virus Engine)
- [CVE-2016-10152](https://cve.now/CVE-2016-10152.md): The read\_config\_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configurat (no CVSS)
- [CVE-2016-8884](https://cve.now/CVE-2016-8884.md): The bmp\_getdata function in libjasper/bmp/bmp\_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer der (no CVSS)
- [CVE-2017-7277](https://cve.now/CVE-2017-7277.md): The TCP stack in the Linux kernel through 4.10.6 mishandles the SCM\_TIMESTAMPING\_OPT\_STATS feature, which allows local users to obtain sensi (no CVSS)
- [CVE-2016-9121](https://cve.now/CVE-2016-9121.md): go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. (no CVSS, Go JOSE All versions before · gopkg.in/square/go-jose.v1 +1)
- [CVE-2016-9122](https://cve.now/CVE-2016-9122.md): go-jose before 1.0.4 suffers from multiple signatures exploitation. (no CVSS, Go JOSE All versions before · gopkg.in/square/go-jose.v1)
- [CVE-2016-9123](https://cve.now/CVE-2016-9123.md): go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. (no CVSS, Go JOSE All versions before · github.com/square/go-jose)
- [CVE-2016-9124](https://cve.now/CVE-2016-9124.md): Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9125](https://cve.now/CVE-2016-9125.md): Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9126](https://cve.now/CVE-2016-9126.md): Revive Adserver before 3.2.3 suffers from persistent XSS. (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9127](https://cve.now/CVE-2016-9127.md): Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9128](https://cve.now/CVE-2016-9128.md): Revive Adserver before 3.2.3 suffers from reflected XSS. (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9129](https://cve.now/CVE-2016-9129.md): Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9130](https://cve.now/CVE-2016-9130.md): Revive Adserver before 3.2.3 suffers from Persistent XSS. (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9454](https://cve.now/CVE-2016-9454.md): Revive Adserver before 3.2.3 suffers from Persistent XSS. (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9455](https://cve.now/CVE-2016-9455.md): Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9456](https://cve.now/CVE-2016-9456.md): Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9457](https://cve.now/CVE-2016-9457.md): Revive Adserver before 3.2.3 suffers from Reflected XSS. (no CVSS, Revive Adserver All versions before)
- [CVE-2016-9459](https://cve.now/CVE-2016-9459.md): Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local (no CVSS, Nextcloud Server & ownCloud Server Nextcloud Server before…)
- [CVE-2016-9460](https://cve.now/CVE-2016-9460.md): Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. (no CVSS, Nextcloud Server & ownCloud Server Nextcloud Server before…)
- [CVE-2016-9461](https://cve.now/CVE-2016-9461.md): Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. (no CVSS, Nextcloud Server & ownCloud Server Nextcloud Server before…)
- [CVE-2016-9462](https://cve.now/CVE-2016-9462.md): Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. (no CVSS, Nextcloud Server & ownCloud Server Nextcloud Server before…)
- [CVE-2016-9463](https://cve.now/CVE-2016-9463.md): Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. (no CVSS, Nextcloud Server & ownCloud Server Nextcloud Server before…)
- [CVE-2016-9464](https://cve.now/CVE-2016-9464.md): Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. (no CVSS, Nextcloud Server Nextcloud Server before 9.0.54 and)
- [CVE-2016-9465](https://cve.now/CVE-2016-9465.md): Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. (no CVSS, Nextcloud Server & ownCloud Server Nextcloud Server before…)
- [CVE-2016-9466](https://cve.now/CVE-2016-9466.md): Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. (no CVSS, Nextcloud Server & ownCloud Server Nextcloud Server before…)
- [CVE-2016-9467](https://cve.now/CVE-2016-9467.md): Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. (no CVSS, Nextcloud Server & ownCloud Server Nextcloud Server before…)
- [CVE-2016-9468](https://cve.now/CVE-2016-9468.md): Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. (no CVSS, Nextcloud Server & ownCloud Server Nextcloud Server before…)
- [CVE-2016-9469](https://cve.now/CVE-2016-9469.md): Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeReques (no CVSS, GitLab Community Edition & GitLab Enterprise Edition 8.13.0…)
- [CVE-2016-9470](https://cve.now/CVE-2016-9470.md): Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. (no CVSS, Revive Adserver All versions before 3.2.5 and)
- [CVE-2016-9471](https://cve.now/CVE-2016-9471.md): Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. (no CVSS, Revive Adserver All versions before 3.2.5 and)
- [CVE-2016-9472](https://cve.now/CVE-2016-9472.md): Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. (no CVSS, Revive Adserver All versions before 3.2.5 and)
- [CVE-2016-9473](https://cve.now/CVE-2016-9473.md): Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to tr (no CVSS, Brave Software Brave Browser iOS before 1.2.18 and Brave Br…)
- [CVE-2017-0881](https://cve.now/CVE-2017-0881.md): An error in the implementation of an autosubscribe feature in the check\_stream\_exists route of the Zulip group chat application server befor (no CVSS, Zulip Server Versions 1.4.2 and below)
- [CVE-2017-0882](https://cve.now/CVE-2017-0882.md): Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. (no CVSS, GitLab Community Edition and GitLab Enterprise Edition 8.7.…)
- [CVE-2017-6964](https://cve.now/CVE-2017-6964.md): dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid fu (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.