CVEs published April 11, 2017
36 CVEs were published on April 11, 2017: 1 critical, 0 high.
- Published
- 36
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- F5 Networks F5 BIG-IP APM
- 1
- org.apache.hadoop:hadoop-common
- 1
- Symantec SSL Visibility
- 1
Critical 1
Medium, low and unrated 35
- CVE-2017-7694Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attac
- CVE-2017-7695Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety ch
- CVE-2017-7697In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
- CVE-2017-7689A Command Injection vulnerability in Schneider Electric homeLYnk Controller exists in all versions before 1.5.0.
- CVE-2017-7691A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator (BWA).
- CVE-2013-6647A use-after-free in AnimationController::endAnimationUpdate in Google Chrome.
- CVE-2014-8354The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds
- CVE-2014-8355PCX parser code in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).
- CVE-2014-8562DCM decode in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).
- CVE-2014-8716The JPEG decoder in ImageMagick before 6.8.9-9 allows local users to cause a denial of service (out-of-bounds memory access and crash).
- CVE-2014-9837coders/pnm.c in ImageMagick 6.9.0-1 Beta and earlier allows remote attackers to cause a denial of service (crash) via a crafted png file.
- CVE-2015-7893SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript.
- CVE-2015-8504Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application
- CVE-2015-8568Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of servic
- CVE-2015-8613Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows l
- CVE-2015-8666Heap-based buffer overflow in QEMU, when built with the Q35-chipset-based PC system emulator.
- CVE-2016-4444The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux
- CVE-2016-4445The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering
- CVE-2016-4446The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial wit
- CVE-2016-4989setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an S
- CVE-2016-5322The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read
- CVE-2017-6088Multiple SQL injection vulnerabilities in EyesOfNetwork (aka EON) 5.0 and earlier allow remote authenticated users to execute arbitrary SQL
- CVE-2016-0779The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a
- CVE-2016-4483The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-b
- CVE-2017-5969libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML
- CVE-2016-4468SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; U
- CVE-2016-5011The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a d
- CVE-2017-5672Kony Enterprise Mobile Management (EMM) before 4.2.5.2 has the vulnerability of disclosing the private key in clear-text when changing the p
- CVE-2017-5873Unquoted Windows search path vulnerability in the guest service in Unisys s-Par before 4.4.20 allows local users to gain privileges via a Tr
- CVE-2017-7461Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows re
- CVE-2017-7462Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web direc
- CVE-2016-10259Symantec SSL Visibility (SSLV) 3.8.4FC, 3.9, 3.10 before 3.10.4.1, and 3.11 before 3.11.3.1 is susceptible to a denial-of-service vulnerabilSymantec SSL Visibility
- CVE-2016-6811In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.org.apache.hadoop:hadoop-common
- CVE-2016-7467The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider wF5 Networks F5 BIG-IP APM
- CVE-2017-7621Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt.