CVEs published April 6, 2017
32 CVEs were published on April 6, 2017: 3 critical, 1 high. 2 are now in CISA KEV.
- Published
- 32
- Critical
- 3
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 2
- Fix available
- 2
Most affected products
- Cisco Wireless LAN Controller
- 3
- Apache Software Foundation Apache Tomcat · org.apache.to… +1
- 1
- Cisco Aironet 1830 Series and 1850 Series Access Points
- 1
- Cloud Foundry Foundation BOSH Azure CPI Release
- 1
- F5 Networks SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orches…
- 1
- F5 Networks SSL Intercept iApp version
- 1
- Objective Development Software Little Snitch
- 1
- org.apache.tika:tika-core
- 1
- Qualcomm Snapdragon 800, 600, 400,
- 1
Critical 3
- CVE-2016-8735Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x beforeApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2017-7574Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability.
- CVE-2017-7575Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\
High 1
Medium, low and unrated 28
- CVE-2015-4673Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or
- CVE-2016-1000307Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web s
- CVE-2017-7576DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username of energetic and password of wireless) mea
- CVE-2015-8965Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the class
- CVE-2016-6809Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files.org.apache.tika:tika-core
- CVE-2016-5349The high level operating systems (HLOS) was not providing sufficient memory address information to ensure that secure applications inside QuQualcomm Snapdragon 800, 600, 400,
- CVE-2017-4964Cloud Foundry Foundation BOSH Azure CPI v22 could potentially allow a maliciously crafted stemcell to execute arbitrary code on VMs created Cloud Foundry Foundation BOSH Azure CPI Release
- CVE-2016-10320textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function.
- CVE-2016-9194A vulnerability in 802.11 Wireless Multimedia Extensions (WME) action frame processing in Cisco Wireless LAN Controller (WLC) Software couldCisco Wireless LAN Controller
- CVE-2016-9219A vulnerability with IPv6 UDP ingress packet processing in Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remoCisco Wireless LAN Controller
- CVE-2017-3832A vulnerability in the web management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacCisco Wireless LAN Controller
- CVE-2017-3834A vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running Cisco Mobility Express Software could allowCisco Aironet 1830 Series and 1850 Series Access Points
- CVE-2017-7572The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authoriz
- CVE-2017-7569In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PH
- CVE-2017-7571public/rolechangeadmin in Faveo 1.9.3 allows CSRF.
- CVE-2017-7566MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.
- CVE-2016-10319In ARM Trusted Firmware 1.2 and 1.3, a malformed firmware update SMC can result in copying unexpectedly large data into secure memory becaus
- CVE-2017-2675Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation vulnerability in the installer part.Objective Development Software Little Snitch
- CVE-2017-7237The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configuratio
- CVE-2017-7565Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041.
- CVE-2017-0305F5 SSL Intercept iApp version 1.5.0 - 1.5.7 is vulnerable to an unauthenticated, remote attack that may allow modification of the BIG-IP sysF5 Networks SSL Intercept iApp version
- CVE-2017-5887WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late; pin
- CVE-2017-6130F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed usinF5 Networks SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orches…
- CVE-2017-6968GMV Checker ATM Security prior to 5.0.18 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka PT-2017-03
- CVE-2017-7192WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it ca
- CVE-2017-7452The iwbmp_read_info_header function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial o
- CVE-2017-7453The iwgif_record_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of se
- CVE-2017-7454The iwgif_record_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of se