# CVEs published 2017-04-06

32 CVEs were published on April 6, 2017: 3 critical, 1 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2015-4673](https://cve.now/CVE-2015-4673.md): Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or (no CVSS)
- [CVE-2016-1000307](https://cve.now/CVE-2016-1000307.md): Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web s (no CVSS)
- [CVE-2017-7576](https://cve.now/CVE-2017-7576.md): DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username of energetic and password of wireless) mea (no CVSS)
- [CVE-2015-8965](https://cve.now/CVE-2015-8965.md): Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the class (no CVSS)
- [CVE-2016-6809](https://cve.now/CVE-2016-6809.md): Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. (no CVSS, org.apache.tika:tika-core)
- [CVE-2016-8735](https://cve.now/CVE-2016-8735.md): Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before (CVSS 9.8, KEV, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2017-7574](https://cve.now/CVE-2017-7574.md): Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. (CVSS 10.0)
- [CVE-2017-7575](https://cve.now/CVE-2017-7575.md): Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \\x00\\x01\\ (CVSS 9.8)
- [CVE-2016-5349](https://cve.now/CVE-2016-5349.md): The high level operating systems (HLOS) was not providing sufficient memory address information to ensure that secure applications inside Qu (no CVSS, Qualcomm Snapdragon 800, 600, 400,)
- [CVE-2017-4964](https://cve.now/CVE-2017-4964.md): Cloud Foundry Foundation BOSH Azure CPI v22 could potentially allow a maliciously crafted stemcell to execute arbitrary code on VMs created (no CVSS, Cloud Foundry Foundation BOSH Azure CPI Release)
- [CVE-2016-10320](https://cve.now/CVE-2016-10320.md): textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. (no CVSS)
- [CVE-2016-9194](https://cve.now/CVE-2016-9194.md): A vulnerability in 802.11 Wireless Multimedia Extensions (WME) action frame processing in Cisco Wireless LAN Controller (WLC) Software could (no CVSS, Cisco Wireless LAN Controller)
- [CVE-2016-9219](https://cve.now/CVE-2016-9219.md): A vulnerability with IPv6 UDP ingress packet processing in Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remo (no CVSS, Cisco Wireless LAN Controller)
- [CVE-2017-3832](https://cve.now/CVE-2017-3832.md): A vulnerability in the web management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attac (no CVSS, Cisco Wireless LAN Controller)
- [CVE-2017-3834](https://cve.now/CVE-2017-3834.md): A vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running Cisco Mobility Express Software could allow (no CVSS, Cisco Aironet 1830 Series and 1850 Series Access Points)
- [CVE-2017-7572](https://cve.now/CVE-2017-7572.md): The \_checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authoriz (no CVSS)
- [CVE-2017-6884](https://cve.now/CVE-2017-6884.md): A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. (CVSS 8.8, KEV)
- [CVE-2017-7569](https://cve.now/CVE-2017-7569.md): In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PH (no CVSS)
- [CVE-2017-7571](https://cve.now/CVE-2017-7571.md): public/rolechangeadmin in Faveo 1.9.3 allows CSRF. (no CVSS)
- [CVE-2017-7566](https://cve.now/CVE-2017-7566.md): MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. (no CVSS)
- [CVE-2016-10319](https://cve.now/CVE-2016-10319.md): In ARM Trusted Firmware 1.2 and 1.3, a malformed firmware update SMC can result in copying unexpectedly large data into secure memory becaus (no CVSS)
- [CVE-2017-2675](https://cve.now/CVE-2017-2675.md): Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation vulnerability in the installer part. (no CVSS, Objective Development Software Little Snitch)
- [CVE-2017-7237](https://cve.now/CVE-2017-7237.md): The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\\configuratio (no CVSS)
- [CVE-2017-7565](https://cve.now/CVE-2017-7565.md): Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041. (no CVSS)
- [CVE-2017-0305](https://cve.now/CVE-2017-0305.md): F5 SSL Intercept iApp version 1.5.0 - 1.5.7 is vulnerable to an unauthenticated, remote attack that may allow modification of the BIG-IP sys (no CVSS, F5 Networks SSL Intercept iApp version)
- [CVE-2017-5887](https://cve.now/CVE-2017-5887.md): WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late; pin (no CVSS)
- [CVE-2017-6130](https://cve.now/CVE-2017-6130.md): F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed usin (no CVSS, F5 Networks SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orches…)
- [CVE-2017-6968](https://cve.now/CVE-2017-6968.md): GMV Checker ATM Security prior to 5.0.18 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka PT-2017-03 (no CVSS)
- [CVE-2017-7192](https://cve.now/CVE-2017-7192.md): WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it ca (no CVSS)
- [CVE-2017-7452](https://cve.now/CVE-2017-7452.md): The iwbmp\_read\_info\_header function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2017-7453](https://cve.now/CVE-2017-7453.md): The iwgif\_record\_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2017-7454](https://cve.now/CVE-2017-7454.md): The iwgif\_record\_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of se (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.