# CVEs published 2017-04-03

48 CVEs were published on April 3, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-7410](https://cve.now/CVE-2017-7410.md): Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attacke (no CVSS)
- [CVE-2017-5684](https://cve.now/CVE-2017-5684.md): The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical ac (no CVSS, Intel Compute Stick STK2MV64CC)
- [CVE-2017-5685](https://cve.now/CVE-2017-5685.md): The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical a (no CVSS, Intel NUC NUC6i7KYK)
- [CVE-2017-5686](https://cve.now/CVE-2017-5686.md): The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical a (no CVSS, Intel NUC NUC6i5SYSH/K, Intel NUC6i3SYSH/K)
- [CVE-2016-10317](https://cve.now/CVE-2016-10317.md): The fill\_threshhold\_buffer function in base/gxht\_thresh.c in Artifex Software, Inc. (no CVSS)
- [CVE-2017-7397](https://cve.now/CVE-2017-7397.md): BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian sourc (no CVSS)
- [CVE-2017-7407](https://cve.now/CVE-2017-7407.md): The ourWriteOut function in tool\_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from p (CVSS 2.4)
- [CVE-2017-7402](https://cve.now/CVE-2017-7402.md): Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=f (no CVSS)
- [CVE-2017-5642](https://cve.now/CVE-2017-5642.md): During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. (no CVSS, Apache Software Foundation Apache Ambari)
- [CVE-2013-7450](https://cve.now/CVE-2013-7450.md): Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations. (no CVSS)
- [CVE-2014-1677](https://cve.now/CVE-2014-1677.md): Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information. (no CVSS)
- [CVE-2014-3927](https://cve.now/CVE-2014-3927.md): mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code. (no CVSS)
- [CVE-2014-3928](https://cve.now/CVE-2014-3928.md): Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credenti (no CVSS)
- [CVE-2014-3929](https://cve.now/CVE-2014-3929.md): The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow (no CVSS)
- [CVE-2014-3930](https://cve.now/CVE-2014-3930.md): lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to (no CVSS)
- [CVE-2017-7400](https://cve.now/CVE-2017-7400.md): OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a (no CVSS, horizon)
- [CVE-2017-7401](https://cve.now/CVE-2017-7401.md): Incorrect interaction of the parse\_packet() and parse\_part\_sign\_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote (no CVSS)
- [CVE-2016-10209](https://cve.now/CVE-2016-10209.md): The archive\_wstring\_append\_from\_mbs function in archive\_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (N (no CVSS)
- [CVE-2016-10210](https://cve.now/CVE-2016-10210.md): libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a cr (no CVSS)
- [CVE-2016-10211](https://cve.now/CVE-2016-10211.md): libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted ru (no CVSS)
- [CVE-2016-10217](https://cve.now/CVE-2016-10217.md): The pdf14\_open function in base/gdevp14.c in Artifex Software, Inc. (no CVSS)
- [CVE-2016-10218](https://cve.now/CVE-2016-10218.md): The pdf14\_pop\_transparency\_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. (no CVSS)
- [CVE-2016-10219](https://cve.now/CVE-2016-10219.md): The intersect function in base/gxfill.c in Artifex Software, Inc. (no CVSS)
- [CVE-2016-10220](https://cve.now/CVE-2016-10220.md): The gs\_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. (no CVSS)
- [CVE-2016-10221](https://cve.now/CVE-2016-10221.md): The count\_entries function in pdf-layer.c in Artifex Software, Inc. (CVSS 4.3)
- [CVE-2016-10222](https://cve.now/CVE-2016-10222.md): runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause (no CVSS)
- [CVE-2016-10226](https://cve.now/CVE-2016-10226.md): JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (bitf (no CVSS)
- [CVE-2016-10312](https://cve.now/CVE-2016-10312.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2016-10313](https://cve.now/CVE-2016-10313.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2016-10314](https://cve.now/CVE-2016-10314.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2016-10315](https://cve.now/CVE-2016-10315.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2016-10316](https://cve.now/CVE-2016-10316.md): Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. (no CVSS)
- [CVE-2017-5923](https://cve.now/CVE-2017-5923.md): libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) v (no CVSS)
- [CVE-2017-5924](https://cve.now/CVE-2017-5924.md): libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted ru (no CVSS)
- [CVE-2017-5949](https://cve.now/CVE-2017-5949.md): JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap (no CVSS)
- [CVE-2017-5950](https://cve.now/CVE-2017-5950.md): The SingleDocParser::HandleNode function in yaml-cpp (aka LibYaml-C++) 0.5.3 allows remote attackers to cause a denial of service (stack con (no CVSS)
- [CVE-2017-5951](https://cve.now/CVE-2017-5951.md): The mem\_get\_bits\_rectangle function in base/gdevmem.c in Artifex Software, Inc. (no CVSS)
- [CVE-2017-6181](https://cve.now/CVE-2017-6181.md): The parse\_char\_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as used in Ruby 2.4.0, allows remo (no CVSS)
- [CVE-2017-6194](https://cve.now/CVE-2017-6194.md): The relocs function in libr/bin/p/bin\_bflt.c in radare2 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overfl (no CVSS)
- [CVE-2017-6441](https://cve.now/CVE-2017-6441.md): The \_zval\_get\_long\_func\_ex in Zend/zend\_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and (no CVSS)
- [CVE-2017-6448](https://cve.now/CVE-2017-6448.md): The dalvik\_disassemble function in libr/asm/p/asm\_dalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service (stack-base (no CVSS)
- [CVE-2017-7378](https://cve.now/CVE-2017-7378.md): The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-bas (no CVSS)
- [CVE-2017-7379](https://cve.now/CVE-2017-7379.md): The PoDoFo::PdfSimpleEncoding::ConvertToEncoding function in PdfEncoding.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2017-7380](https://cve.now/CVE-2017-7380.md): The doc/PdfPage.cpp:614:20 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and applicati (no CVSS)
- [CVE-2017-7381](https://cve.now/CVE-2017-7381.md): The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and applicati (no CVSS)
- [CVE-2017-7382](https://cve.now/CVE-2017-7382.md): The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and applic (no CVSS)
- [CVE-2017-7383](https://cve.now/CVE-2017-7383.md): The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and applic (no CVSS)
- [CVE-2017-1001000](https://cve.now/CVE-2017-1001000.md): The register\_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.