# CVEs published 2017-03-29

32 CVEs were published on March 29, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-4977](https://cve.now/CVE-2017-4977.md): EMC RSA Archer Security Operations Management with RSA Unified Collector Framework versions prior to 1.3.1.52 contain a sensitive informatio (no CVSS, RSA Archer Security Operations Management with RSA Unified…)
- [CVE-2017-4980](https://cve.now/CVE-2017-4980.md): EMC Isilon OneFS is affected by a path traversal vulnerability that may potentially be exploited by attackers to compromise the affected sys (no CVSS, EMC Isilon OneFS EMC Isilon OneFS 8.0.0 8.0.0.1, EMC Isilon…)
- [CVE-2017-7310](https://cve.now/CVE-2017-7310.md): A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 1 (no CVSS)
- [CVE-2014-3582](https://cve.now/CVE-2014-3582.md): In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certif (no CVSS)
- [CVE-2016-2379](https://cve.now/CVE-2016-2379.md): The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by levera (no CVSS)
- [CVE-2016-4976](https://cve.now/CVE-2016-4976.md): Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive (no CVSS, org.apache.ambari:ambari)
- [CVE-2016-6349](https://cve.now/CVE-2016-6349.md): The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by ru (no CVSS)
- [CVE-2017-7258](https://cve.now/CVE-2017-7258.md): HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. (no CVSS)
- [CVE-2017-7308](https://cve.now/CVE-2017-7308.md): The packet\_set\_ring function in net/packet/af\_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data (no CVSS)
- [CVE-2017-7299](https://cve.now/CVE-2017-7299.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code (no CVSS)
- [CVE-2017-7300](https://cve.now/CVE-2017-7300.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout\_link\_add\_symbols function in bfd/aou (no CVSS)
- [CVE-2017-7301](https://cve.now/CVE-2017-7301.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout\_link\_add\_symbols function in bfd/aou (no CVSS)
- [CVE-2017-7302](https://cve.now/CVE-2017-7302.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap\_std\_reloc\_out function in bfd/aoutx.h (no CVSS)
- [CVE-2017-7303](https://cve.now/CVE-2017-7303.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) bec (no CVSS)
- [CVE-2017-7304](https://cve.now/CVE-2017-7304.md): The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) bec (no CVSS)
- [CVE-2009-5147](https://cve.now/CVE-2009-5147.md): DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names. (no CVSS)
- [CVE-2015-4556](https://cve.now/CVE-2015-4556.md): The string-translate\* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (c (no CVSS)
- [CVE-2015-8234](https://cve.now/CVE-2015-8234.md): The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted (no CVSS, glance)
- [CVE-2016-6846](https://cve.now/CVE-2016-6846.md): Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7. (no CVSS)
- [CVE-2016-9924](https://cve.now/CVE-2016-9924.md): Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks. (no CVSS)
- [CVE-2017-5671](https://cve.now/CVE-2017-5671.md): Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have (no CVSS)
- [CVE-2017-5900](https://cve.now/CVE-2017-5900.md): Cross-site scripting (XSS) vulnerability in the NetComm NB16WV-02 router with firmware NB16WV\_R0.09 allows remote authenticated users to inj (no CVSS)
- [CVE-2017-7285](https://cve.now/CVE-2017-7285.md): A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaus (no CVSS)
- [CVE-2017-7298](https://cve.now/CVE-2017-7298.md): In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG (no CVSS, moodle/moodle)
- [CVE-2017-7294](https://cve.now/CVE-2017-7294.md): The vmw\_surface\_define\_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx\_surface.c in the Linux kernel through 4.10.6 does not validate additi (no CVSS)
- [CVE-2017-2686](https://cve.now/CVE-2017-2686.md): Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the we (no CVSS, RUGGEDCOM ROX I All versions)
- [CVE-2017-2687](https://cve.now/CVE-2017-2687.md): Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability in the integrated web server at port 10000/TCP which is prone to reflected Cr (no CVSS, RUGGEDCOM ROX I All versions)
- [CVE-2017-2688](https://cve.now/CVE-2017-2688.md): The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow remote attackers to perform actions with t (no CVSS, RUGGEDCOM ROX I All versions)
- [CVE-2017-2689](https://cve.now/CVE-2017-2689.md): Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to o (no CVSS, RUGGEDCOM ROX I All versions)
- [CVE-2017-6864](https://cve.now/CVE-2017-6864.md): The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow an authenticated user to perform stored Cr (no CVSS, RUGGEDCOM ROX I All versions)
- [CVE-2017-5226](https://cve.now/CVE-2017-5226.md): When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push (no CVSS)
- [CVE-2017-7297](https://cve.now/CVE-2017-7297.md): Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. (no CVSS, github.com/rancher/rancher)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.