# CVEs published 2017-03-31

36 CVEs were published on March 31, 2017: 1 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-7386](https://cve.now/CVE-2017-7386.md): citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter). (no CVSS)
- [CVE-2017-7387](https://cve.now/CVE-2017-7387.md): TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter (no CVSS)
- [CVE-2016-8032](https://cve.now/CVE-2016-8032.md): Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attackers to bypass local (no CVSS, Intel Anti-Virus Engine)
- [CVE-2017-7374](https://cve.now/CVE-2017-7374.md): Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service (NULL pointer d (no CVSS)
- [CVE-2016-6560](https://cve.now/CVE-2016-6560.md): illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash. (no CVSS, illumos osnet-incorporation)
- [CVE-2016-6561](https://cve.now/CVE-2016-6561.md): illumos smbsrv NULL pointer dereference allows system crash. (no CVSS, illumos osnet-incorporation)
- [CVE-2016-6022](https://cve.now/CVE-2016-6022.md): IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-6031](https://cve.now/CVE-2016-6031.md): IBM Rational Quality Manager 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-6036](https://cve.now/CVE-2016-6036.md): IBM Rational Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-6111](https://cve.now/CVE-2016-6111.md): IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) erro (no CVSS, IBM Cram Social Program Management)
- [CVE-2016-8917](https://cve.now/CVE-2016-8917.md): IBM Sterling Order Management 9.2 - 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and u (no CVSS, IBM Sterling Order Management)
- [CVE-2016-8935](https://cve.now/CVE-2016-8935.md): IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-9707](https://cve.now/CVE-2016-9707.md): IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-9990](https://cve.now/CVE-2016-9990.md): IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. (no CVSS, IBM iNotes)
- [CVE-2017-1154](https://cve.now/CVE-2017-1154.md): IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to files in the local environment which s (no CVSS, IBM Algo One)
- [CVE-2017-1171](https://cve.now/CVE-2017-1171.md): The IBM TRIRIGA Application Platform 3.3, 3,4, and 3,5 contain a vulnerability that could allow an authenticated user to execute Application (no CVSS, IBM TRIRIGA Application Platform)
- [CVE-2017-2775](https://cve.now/CVE-2017-2775.md): An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 (CVSS 7.5, National Instruments LabVIEW 2016 Evaluation)
- [CVE-2008-7313](https://cve.now/CVE-2008-7313.md): The \_httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. (no CVSS)
- [CVE-2014-3931](https://cve.now/CVE-2014-3931.md): fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corru (CVSS 9.8, KEV)
- [CVE-2014-5008](https://cve.now/CVE-2014-5008.md): Snoopy allows remote attackers to execute arbitrary commands. (no CVSS)
- [CVE-2014-5009](https://cve.now/CVE-2014-5009.md): Snoopy allows remote attackers to execute arbitrary commands. (no CVSS)
- [CVE-2014-9114](https://cve.now/CVE-2014-9114.md): Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code. (CVSS 7.8)
- [CVE-2015-4624](https://cve.now/CVE-2015-4624.md): Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens. (no CVSS)
- [CVE-2016-6209](https://cve.now/CVE-2016-6209.md): Cross-site scripting (XSS) vulnerability in Nagios. (no CVSS)
- [CVE-2017-3009](https://cve.now/CVE-2017-3009.md): Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable buffer overflow vu (no CVSS, Adobe Acrobat Reader 15.020.20042 and earlier, 15.006.30244…)
- [CVE-2017-3010](https://cve.now/CVE-2017-3010.md): Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption (no CVSS, Adobe Acrobat Reader 15.020.20042 and earlier, 15.006.30244…)
- [CVE-2017-2647](https://cve.now/CVE-2017-2647.md): The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer derefere (no CVSS)
- [CVE-2017-6973](https://cve.now/CVE-2017-6973.md): A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm\_config\_report.php) allows remote attackers to inje (no CVSS, mantisbt/mantisbt)
- [CVE-2017-7241](https://cve.now/CVE-2017-7241.md): A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move\_attachments\_page.php, part of admin tools) allows rem (no CVSS, mantisbt/mantisbt)
- [CVE-2017-7309](https://cve.now/CVE-2017-7309.md): A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm\_config\_report.php) allows remote attackers to inje (no CVSS, mantisbt/mantisbt)
- [CVE-2017-7359](https://cve.now/CVE-2017-7359.md): Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack. (no CVSS)
- [CVE-2017-7360](https://cve.now/CVE-2017-7360.md): Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack. (no CVSS)
- [CVE-2017-7361](https://cve.now/CVE-2017-7361.md): Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack. (no CVSS)
- [CVE-2017-7362](https://cve.now/CVE-2017-7362.md): Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack. (no CVSS)
- [CVE-2017-7363](https://cve.now/CVE-2017-7363.md): Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack. (no CVSS)
- [CVE-2016-9319](https://cve.now/CVE-2016-9319.md): There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.