# CVEs published 2017-04-10

98 CVEs were published on April 10, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-8235](https://cve.now/CVE-2016-8235.md): Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute c (no CVSS, Lenovo Group Customer Care Software Development Kit)
- [CVE-2016-8237](https://cve.now/CVE-2016-8237.md): Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code. (no CVSS, Lenovo Group Lenovo Updates)
- [CVE-2017-7646](https://cve.now/CVE-2017-7646.md): SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server's filesystem and read the conte (no CVSS)
- [CVE-2017-7647](https://cve.now/CVE-2017-7647.md): SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands. (no CVSS)
- [CVE-2017-7648](https://cve.now/CVE-2017-7648.md): Foscam networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to (no CVSS)
- [CVE-2016-10322](https://cve.now/CVE-2016-10322.md): Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the (no CVSS)
- [CVE-2016-10323](https://cve.now/CVE-2016-10323.md): Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto\_dsm\_user --copy- (no CVSS)
- [CVE-2017-7622](https://cve.now/CVE-2017-7622.md): dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to (no CVSS)
- [CVE-2017-7623](https://cve.now/CVE-2017-7623.md): The iwmiffr\_convert\_row32 function in imagew-miff.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2017-7624](https://cve.now/CVE-2017-7624.md): The iw\_read\_bmp\_file function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of a (no CVSS)
- [CVE-2017-7625](https://cve.now/CVE-2017-7625.md): In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app\_theme/libs/save\_file.php" and t (no CVSS)
- [CVE-2016-5041](https://cve.now/CVE-2016-5041.md): dwarf\_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a debugging i (no CVSS)
- [CVE-2015-7824](https://cve.now/CVE-2015-7824.md): botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC (no CVSS)
- [CVE-2015-7825](https://cve.now/CVE-2015-7825.md): botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service (infinite loop and m (no CVSS)
- [CVE-2015-7826](https://cve.now/CVE-2015-7826.md): botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified i (no CVSS)
- [CVE-2016-10310](https://cve.now/CVE-2016-10310.md): Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17 and possibly earlier allows remote authenticated use (no CVSS)
- [CVE-2016-10311](https://cve.now/CVE-2016-10311.md): Stack-based buffer overflow in SAP NetWeaver 7.0 through 7.5 allows remote attackers to cause a denial of service () by sending a crafted pa (no CVSS)
- [CVE-2016-6878](https://cve.now/CVE-2016-6878.md): The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified imp (no CVSS)
- [CVE-2016-6879](https://cve.now/CVE-2016-6879.md): The X509\_Certificate::allowed\_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a (no CVSS)
- [CVE-2017-5607](https://cve.now/CVE-2017-5607.md): Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6. (no CVSS)
- [CVE-2017-5983](https://cve.now/CVE-2017-5983.md): The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote (no CVSS)
- [CVE-2017-5988](https://cve.now/CVE-2017-5988.md): NetApp Clustered Data ONTAP 8.1 through 9.1P1, when NFS or SMB is enabled, allows remote attackers to cause a denial of service via unspecif (no CVSS)
- [CVE-2017-7185](https://cve.now/CVE-2017-7185.md): Use-after-free vulnerability in the mg\_http\_multipart\_wait\_for\_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Libra (no CVSS)
- [CVE-2017-7239](https://cve.now/CVE-2017-7239.md): Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan results, or cause a deni (no CVSS)
- [CVE-2017-7345](https://cve.now/CVE-2017-7345.md): NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management (no CVSS)
- [CVE-2017-7377](https://cve.now/CVE-2017-7377.md): The (1) v9fs\_create and (2) v9fs\_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cau (no CVSS)
- [CVE-2015-8378](https://cve.now/CVE-2015-8378.md): In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. (no CVSS)
- [CVE-2016-10304](https://cve.now/CVE-2016-10304.md): The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory erro (no CVSS)
- [CVE-2016-10321](https://cve.now/CVE-2016-10321.md): web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-for (no CVSS, web2py)
- [CVE-2016-6605](https://cve.now/CVE-2016-6605.md): Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization. (no CVSS)
- [CVE-2017-6190](https://cve.now/CVE-2017-6190.md): Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to (no CVSS)
- [CVE-2017-7616](https://cve.now/CVE-2017-7616.md): Incorrect error handling in the set\_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local us (no CVSS)
- [CVE-2017-7617](https://cve.now/CVE-2017-7617.md): Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13 (no CVSS)
- [CVE-2017-7618](https://cve.now/CVE-2017-7618.md): crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and (no CVSS)
- [CVE-2017-7619](https://cve.now/CVE-2017-7619.md): In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms. (no CVSS)
- [CVE-2014-2960](https://cve.now/CVE-2014-2960.md): Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and confi (no CVSS, Vision Critical before 2014-05-30)
- [CVE-2015-2880](https://cve.now/CVE-2015-2880.md): TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account. (no CVSS, TRENDnet WiFi Baby Cam TV-IP743SIC)
- [CVE-2015-2881](https://cve.now/CVE-2015-2881.md): Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account. (no CVSS, Gynoii)
- [CVE-2015-2882](https://cve.now/CVE-2015-2882.md): Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a p (no CVSS, Philips In.Sight B120/37)
- [CVE-2015-2883](https://cve.now/CVE-2015-2883.md): Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or sh (no CVSS, Philips In.Sight B120/37)
- [CVE-2015-2884](https://cve.now/CVE-2015-2884.md): Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u (no CVSS, Philips In.Sight B120/37)
- [CVE-2015-2885](https://cve.now/CVE-2015-2885.md): Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password o (no CVSS, Lens Peek-a-View)
- [CVE-2015-2886](https://cve.now/CVE-2015-2886.md): iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service. (no CVSS, iBaby M6)
- [CVE-2015-2887](https://cve.now/CVE-2015-2887.md): iBaby M3S has a password of admin for the backdoor admin account. (no CVSS, iBaby M3S)
- [CVE-2015-2888](https://cve.now/CVE-2015-2888.md): Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication, related to the MySnapCam web servi (no CVSS, Summer Baby Zoom Wifi Monitor & Internet Viewing System)
- [CVE-2015-2889](https://cve.now/CVE-2015-2889.md): Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain privileges via manual entry of a Settings URL. (no CVSS, Summer Baby Zoom Wifi Monitor & Internet Viewing System)
- [CVE-2015-6021](https://cve.now/CVE-2015-6021.md): Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response. (no CVSS, Spiceworks Desktop before 2015-12-01)
- [CVE-2015-6027](https://cve.now/CVE-2015-6027.md): Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP. (no CVSS, Castle Rock Computing SNMPc before 2015-12-17)
- [CVE-2015-6028](https://cve.now/CVE-2015-6028.md): Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter. (no CVSS, Castle Rock Computing SNMPc before 2015-12-17)
- [CVE-2015-6035](https://cve.now/CVE-2015-6035.md): Opsview before 2015-11-06 has XSS via SNMP. (no CVSS, Opsview before 2015-11-06)
- [CVE-2015-7260](https://cve.now/CVE-2015-7260.md): Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file. (no CVSS, Liebert MultiLink Automated Shutdown)
- [CVE-2015-7263](https://cve.now/CVE-2015-7263.md): The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a cra (no CVSS, Facebook Proxygen before 2015-11-09)
- [CVE-2015-7264](https://cve.now/CVE-2015-7264.md): The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks (no CVSS, Facebook Proxygen before 2015-11-09)
- [CVE-2015-7265](https://cve.now/CVE-2015-7265.md): Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and byp (no CVSS, Facebook Proxygen before 2015-11-09)
- [CVE-2015-7270](https://cve.now/CVE-2015-7270.md): Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal. (no CVSS, Dell Integrated Remote Access Controller)
- [CVE-2015-7271](https://cve.now/CVE-2015-7271.md): Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo. (no CVSS, Dell Integrated Remote Access Controller)
- [CVE-2015-7272](https://cve.now/CVE-2015-7272.md): Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buff (no CVSS, Dell Integrated Remote Access Controller)
- [CVE-2015-7273](https://cve.now/CVE-2015-7273.md): Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE. (no CVSS, Dell Integrated Remote Access Controller)
- [CVE-2015-7274](https://cve.now/CVE-2015-7274.md): Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands. (no CVSS, Dell Integrated Remote Access Controller)
- [CVE-2015-7275](https://cve.now/CVE-2015-7275.md): Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS. (no CVSS, Dell Integrated Remote Access Controller)
- [CVE-2015-7292](https://cve.now/CVE-2015-7292.md): Stack-based buffer overflow in the havok\_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attacker (no CVSS, Amazon Fire OS before 2016-01-15)
- [CVE-2015-8255](https://cve.now/CVE-2015-8255.md): AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local\_del.cgi. (no CVSS, AXIS Communications products)
- [CVE-2015-8258](https://cve.now/CVE-2015-8258.md): AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Ope (no CVSS, AXIS Communications products with firmware through 5.80.x)
- [CVE-2015-8275](https://cve.now/CVE-2015-8275.md): LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4\_01 allow attackers to write to arbitrary files via crafted EDOC files. (no CVSS, LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4\_01)
- [CVE-2015-8276](https://cve.now/CVE-2015-8276.md): LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4\_01 allow attackers to read arbitrary files via crafted EDOC files. (no CVSS, LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4\_01)
- [CVE-2016-1516](https://cve.now/CVE-2016-1516.md): OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. (no CVSS, OpenCV · opencv-python +1)
- [CVE-2016-1517](https://cve.now/CVE-2016-1517.md): OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks. (no CVSS, OpenCV · opencv-contrib-python +1)
- [CVE-2016-4317](https://cve.now/CVE-2016-4317.md): Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page. (no CVSS, Atlassian Confluence Server before)
- [CVE-2016-4318](https://cve.now/CVE-2016-4318.md): Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name. (no CVSS, Atlassian JIRA Server before)
- [CVE-2016-4319](https://cve.now/CVE-2016-4319.md): Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings. (no CVSS, Atlassian JIRA Server before)
- [CVE-2016-4320](https://cve.now/CVE-2016-4320.md): Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack (no CVSS, Atlassian Bitbucket Server before)
- [CVE-2016-4334](https://cve.now/CVE-2016-4334.md): Jive before 2016.3.1 has an open redirect from the external-link.jspa page. (no CVSS, Jive before)
- [CVE-2016-5051](https://cve.now/CVE-2016-5051.md): OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application. (no CVSS, OSRAM SYLVANIA Osram Lightify Home before 2016-07-26)
- [CVE-2016-5052](https://cve.now/CVE-2016-5052.md): OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning. (no CVSS, OSRAM SYLVANIA Osram Lightify Home through 2016-07-26)
- [CVE-2016-5053](https://cve.now/CVE-2016-5053.md): OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000. (no CVSS, OSRAM SYLVANIA Osram Lightify Home before 2016-07-26)
- [CVE-2016-5054](https://cve.now/CVE-2016-5054.md): OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay. (no CVSS, OSRAM SYLVANIA Osram Lightify Home through 2016-07-26)
- [CVE-2016-5055](https://cve.now/CVE-2016-5055.md): OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page. (no CVSS, OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26)
- [CVE-2016-5056](https://cve.now/CVE-2016-5056.md): OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK. (no CVSS, OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26)
- [CVE-2016-5057](https://cve.now/CVE-2016-5057.md): OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning. (no CVSS, OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26)
- [CVE-2016-5058](https://cve.now/CVE-2016-5058.md): OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay. (no CVSS, OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26)
- [CVE-2016-5059](https://cve.now/CVE-2016-5059.md): OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/v (no CVSS, OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26)
- [CVE-2016-5065](https://cve.now/CVE-2016-5065.md): Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded\_Ace\_Set\_Task.cgi command injection. (no CVSS, Sierra Wireless GX 440 devices with ALEOS firmware)
- [CVE-2016-5066](https://cve.now/CVE-2016-5066.md): Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user. (no CVSS, Sierra Wireless GX 440 devices with ALEOS firmware)
- [CVE-2016-5067](https://cve.now/CVE-2016-5067.md): Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection. (no CVSS, Sierra Wireless GX 440 devices with ALEOS firmware)
- [CVE-2016-5068](https://cve.now/CVE-2016-5068.md): Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded\_Ace\_Get\_Task.cgi requests. (no CVSS, Sierra Wireless GX 440 devices with ALEOS firmware)
- [CVE-2016-5069](https://cve.now/CVE-2016-5069.md): Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL. (no CVSS, Sierra Wireless GX 440 devices with ALEOS firmware)
- [CVE-2016-5070](https://cve.now/CVE-2016-5070.md): Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext. (no CVSS, Sierra Wireless GX 440 devices with ALEOS firmware)
- [CVE-2016-5071](https://cve.now/CVE-2016-5071.md): Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root. (no CVSS, Sierra Wireless GX 440 devices with ALEOS firmware)
- [CVE-2016-5072](https://cve.now/CVE-2016-5072.md): OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. (no CVSS, OXID eShop before 2016-06-13)
- [CVE-2016-5073](https://cve.now/CVE-2016-5073.md): CloudView NMS before 2.10a has XSS via SNMP. (no CVSS, CloudView NMS before)
- [CVE-2016-5074](https://cve.now/CVE-2016-5074.md): CloudView NMS before 2.10a has a format string issue exploitable over SNMP. (no CVSS, CloudView NMS before)
- [CVE-2016-5075](https://cve.now/CVE-2016-5075.md): CloudView NMS before 2.10a has XSS via a TELNET login. (no CVSS, CloudView NMS before)
- [CVE-2016-5076](https://cve.now/CVE-2016-5076.md): CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def. (no CVSS, CloudView NMS before)
- [CVE-2016-5077](https://cve.now/CVE-2016-5077.md): Netikus EventSentry before 3.2.1.44 has XSS via SNMP. (no CVSS, Netikus EventSentry before)
- [CVE-2016-5078](https://cve.now/CVE-2016-5078.md): Paessler PRTG before 16.2.24.4045 has XSS via SNMP. (no CVSS, Paessler PRTG before)
- [CVE-2016-5642](https://cve.now/CVE-2016-5642.md): Opmantek NMIS before 8.5.12G has XSS via SNMP. (no CVSS, Opmantek NMIS before)
- [CVE-2016-5682](https://cve.now/CVE-2016-5682.md): Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section. (no CVSS, Swagger-UI before · swagger-ui)
- [CVE-2016-6534](https://cve.now/CVE-2016-6534.md): Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. (no CVSS, Opmantek NMIS before)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.