CVEs published April 10, 2017
98 CVEs were published on April 10, 2017: 0 critical, 0 high.
- Published
- 98
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 98
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Sierra Wireless GX 440 devices with ALEOS firmware
- 7
- Dell Integrated Remote Access Controller
- 6
- CloudView NMS before
- 4
- Facebook Proxygen before 2015-11-09
- 3
- OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26
- 3
- Philips In.Sight B120/37
- 3
- Atlassian JIRA Server before
- 2
- Castle Rock Computing SNMPc before 2015-12-17
- 2
- LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01
- 2
- Opmantek NMIS before
- 2
Medium, low and unrated 98
- CVE-2016-8235Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute cLenovo Group Customer Care Software Development Kit
- CVE-2016-8237Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.Lenovo Group Lenovo Updates
- CVE-2017-7646SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server's filesystem and read the conte
- CVE-2017-7647SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands.
- CVE-2017-7648Foscam networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to
- CVE-2016-10322Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the
- CVE-2016-10323Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-
- CVE-2017-7622dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to
- CVE-2017-7623The iwmiffr_convert_row32 function in imagew-miff.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial o
- CVE-2017-7624The iw_read_bmp_file function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of a
- CVE-2017-7625In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs/save_file.php" and t
- CVE-2016-5041dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging i
- CVE-2015-7824botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC
- CVE-2015-7825botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service (infinite loop and m
- CVE-2015-7826botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified i
- CVE-2016-10310Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17 and possibly earlier allows remote authenticated use
- CVE-2016-10311Stack-based buffer overflow in SAP NetWeaver 7.0 through 7.5 allows remote attackers to cause a denial of service () by sending a crafted pa
- CVE-2016-6878The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified imp
- CVE-2016-6879The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a
- CVE-2017-5607Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.
- CVE-2017-5983The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote
- CVE-2017-5988NetApp Clustered Data ONTAP 8.1 through 9.1P1, when NFS or SMB is enabled, allows remote attackers to cause a denial of service via unspecif
- CVE-2017-7185Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Libra
- CVE-2017-7239Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan results, or cause a deni
- CVE-2017-7345NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management
- CVE-2017-7377The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cau
- CVE-2015-8378In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action.
- CVE-2016-10304The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory erro
- CVE-2016-10321web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-forweb2py
- CVE-2016-6605Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.
- CVE-2017-6190Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to
- CVE-2017-7616Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local us
- CVE-2017-7617Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13
- CVE-2017-7618crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and
- CVE-2017-7619In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms.
- CVE-2014-2960Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and confiVision Critical before 2014-05-30
- CVE-2015-2880TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account.TRENDnet WiFi Baby Cam TV-IP743SIC
- CVE-2015-2881Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account.Gynoii
- CVE-2015-2882Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a pPhilips In.Sight B120/37
- CVE-2015-2883Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shPhilips In.Sight B120/37
- CVE-2015-2884Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3uPhilips In.Sight B120/37
- CVE-2015-2885Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password oLens Peek-a-View
- CVE-2015-2886iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service.iBaby M6
- CVE-2015-2887iBaby M3S has a password of admin for the backdoor admin account.iBaby M3S
- CVE-2015-2888Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication, related to the MySnapCam web serviSummer Baby Zoom Wifi Monitor & Internet Viewing System
- CVE-2015-2889Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain privileges via manual entry of a Settings URL.Summer Baby Zoom Wifi Monitor & Internet Viewing System
- CVE-2015-6021Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.Spiceworks Desktop before 2015-12-01
- CVE-2015-6027Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP.Castle Rock Computing SNMPc before 2015-12-17
- CVE-2015-6028Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter.Castle Rock Computing SNMPc before 2015-12-17
- CVE-2015-6035Opsview before 2015-11-06 has XSS via SNMP.Opsview before 2015-11-06
- CVE-2015-7260Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file.Liebert MultiLink Automated Shutdown
- CVE-2015-7263The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a craFacebook Proxygen before 2015-11-09
- CVE-2015-7264The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacksFacebook Proxygen before 2015-11-09
- CVE-2015-7265Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypFacebook Proxygen before 2015-11-09
- CVE-2015-7270Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal.Dell Integrated Remote Access Controller
- CVE-2015-7271Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo.Dell Integrated Remote Access Controller
- CVE-2015-7272Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffDell Integrated Remote Access Controller
- CVE-2015-7273Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.Dell Integrated Remote Access Controller
- CVE-2015-7274Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands.Dell Integrated Remote Access Controller
- CVE-2015-7275Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.Dell Integrated Remote Access Controller
- CVE-2015-7292Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attackerAmazon Fire OS before 2016-01-15
- CVE-2015-8255AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.AXIS Communications products
- CVE-2015-8258AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving OpeAXIS Communications products with firmware through 5.80.x
- CVE-2015-8275LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01
- CVE-2015-8276LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to read arbitrary files via crafted EDOC files.LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01
- CVE-2016-1516OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.OpenCV · opencv-python +1
- CVE-2016-1517OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks.OpenCV · opencv-contrib-python +1
- CVE-2016-4317Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page.Atlassian Confluence Server before
- CVE-2016-4318Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name.Atlassian JIRA Server before
- CVE-2016-4319Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings.Atlassian JIRA Server before
- CVE-2016-4320Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attackAtlassian Bitbucket Server before
- CVE-2016-4334Jive before 2016.3.1 has an open redirect from the external-link.jspa page.Jive before
- CVE-2016-5051OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.OSRAM SYLVANIA Osram Lightify Home before 2016-07-26
- CVE-2016-5052OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.OSRAM SYLVANIA Osram Lightify Home through 2016-07-26
- CVE-2016-5053OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000.OSRAM SYLVANIA Osram Lightify Home before 2016-07-26
- CVE-2016-5054OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay.OSRAM SYLVANIA Osram Lightify Home through 2016-07-26
- CVE-2016-5055OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26
- CVE-2016-5056OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26
- CVE-2016-5057OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26
- CVE-2016-5058OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26
- CVE-2016-5059OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/vOSRAM SYLVANIA Osram Lightify Pro before 2016-07-26
- CVE-2016-5065Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.Sierra Wireless GX 440 devices with ALEOS firmware
- CVE-2016-5066Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.Sierra Wireless GX 440 devices with ALEOS firmware
- CVE-2016-5067Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection.Sierra Wireless GX 440 devices with ALEOS firmware
- CVE-2016-5068Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.Sierra Wireless GX 440 devices with ALEOS firmware
- CVE-2016-5069Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.Sierra Wireless GX 440 devices with ALEOS firmware
- CVE-2016-5070Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext.Sierra Wireless GX 440 devices with ALEOS firmware
- CVE-2016-5071Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root.Sierra Wireless GX 440 devices with ALEOS firmware
- CVE-2016-5072OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class.OXID eShop before 2016-06-13
- CVE-2016-5073CloudView NMS before 2.10a has XSS via SNMP.CloudView NMS before
- CVE-2016-5074CloudView NMS before 2.10a has a format string issue exploitable over SNMP.CloudView NMS before
- CVE-2016-5075CloudView NMS before 2.10a has XSS via a TELNET login.CloudView NMS before
- CVE-2016-5076CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def.CloudView NMS before
- CVE-2016-5077Netikus EventSentry before 3.2.1.44 has XSS via SNMP.Netikus EventSentry before
- CVE-2016-5078Paessler PRTG before 16.2.24.4045 has XSS via SNMP.Paessler PRTG before
- CVE-2016-5642Opmantek NMIS before 8.5.12G has XSS via SNMP.Opmantek NMIS before
- CVE-2016-5682Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.Swagger-UI before · swagger-ui
- CVE-2016-6534Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script.Opmantek NMIS before