# CVEs published 2017-04-11

36 CVEs were published on April 11, 2017: 1 critical, 0 high. Days are UTC.

- [CVE-2017-7694](https://cve.now/CVE-2017-7694.md): Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attac (no CVSS)
- [CVE-2017-7695](https://cve.now/CVE-2017-7695.md): Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php\[space\]' file, they could bypass a safety ch (no CVSS)
- [CVE-2017-7697](https://cve.now/CVE-2017-7697.md): In libsamplerate before 0.1.9, a buffer over-read occurs in the calc\_output\_single function in src\_sinc.c via a crafted audio file. (no CVSS)
- [CVE-2017-7689](https://cve.now/CVE-2017-7689.md): A Command Injection vulnerability in Schneider Electric homeLYnk Controller exists in all versions before 1.5.0. (no CVSS)
- [CVE-2017-7691](https://cve.now/CVE-2017-7691.md): A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator (BWA). (no CVSS)
- [CVE-2013-6647](https://cve.now/CVE-2013-6647.md): A use-after-free in AnimationController::endAnimationUpdate in Google Chrome. (no CVSS)
- [CVE-2014-8354](https://cve.now/CVE-2014-8354.md): The HorizontalFilter function in resize.c in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds (no CVSS)
- [CVE-2014-8355](https://cve.now/CVE-2014-8355.md): PCX parser code in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read). (no CVSS)
- [CVE-2014-8562](https://cve.now/CVE-2014-8562.md): DCM decode in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read). (no CVSS)
- [CVE-2014-8716](https://cve.now/CVE-2014-8716.md): The JPEG decoder in ImageMagick before 6.8.9-9 allows local users to cause a denial of service (out-of-bounds memory access and crash). (no CVSS)
- [CVE-2014-9837](https://cve.now/CVE-2014-9837.md): coders/pnm.c in ImageMagick 6.9.0-1 Beta and earlier allows remote attackers to cause a denial of service (crash) via a crafted png file. (no CVSS)
- [CVE-2015-7893](https://cve.now/CVE-2015-7893.md): SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript. (no CVSS)
- [CVE-2015-8504](https://cve.now/CVE-2015-8504.md): Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application (no CVSS)
- [CVE-2015-8568](https://cve.now/CVE-2015-8568.md): Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of servic (no CVSS)
- [CVE-2015-8613](https://cve.now/CVE-2015-8613.md): Stack-based buffer overflow in the megasas\_ctrl\_get\_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows l (no CVSS)
- [CVE-2015-8666](https://cve.now/CVE-2015-8666.md): Heap-based buffer overflow in QEMU, when built with the Q35-chipset-based PC system emulator. (no CVSS)
- [CVE-2016-4444](https://cve.now/CVE-2016-4444.md): The allow\_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux (no CVSS)
- [CVE-2016-4445](https://cve.now/CVE-2016-4445.md): The fix\_lookup\_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering (no CVSS)
- [CVE-2016-4446](https://cve.now/CVE-2016-4446.md): The allow\_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial wit (no CVSS)
- [CVE-2016-4989](https://cve.now/CVE-2016-4989.md): setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an S (no CVSS)
- [CVE-2016-5322](https://cve.now/CVE-2016-5322.md): The setByteArray function in tif\_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read (no CVSS)
- [CVE-2017-6088](https://cve.now/CVE-2017-6088.md): Multiple SQL injection vulnerabilities in EyesOfNetwork (aka EON) 5.0 and earlier allow remote authenticated users to execute arbitrary SQL (no CVSS)
- [CVE-2016-0779](https://cve.now/CVE-2016-0779.md): The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2016-4483](https://cve.now/CVE-2016-4483.md): The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-b (no CVSS)
- [CVE-2017-5969](https://cve.now/CVE-2017-5969.md): libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML (no CVSS)
- [CVE-2016-4468](https://cve.now/CVE-2016-4468.md): SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; U (no CVSS)
- [CVE-2016-5011](https://cve.now/CVE-2016-5011.md): The parse\_dos\_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a d (no CVSS)
- [CVE-2017-5672](https://cve.now/CVE-2017-5672.md): Kony Enterprise Mobile Management (EMM) before 4.2.5.2 has the vulnerability of disclosing the private key in clear-text when changing the p (no CVSS)
- [CVE-2017-5873](https://cve.now/CVE-2017-5873.md): Unquoted Windows search path vulnerability in the guest service in Unisys s-Par before 4.4.20 allows local users to gain privileges via a Tr (no CVSS)
- [CVE-2017-7461](https://cve.now/CVE-2017-7461.md): Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows re (no CVSS)
- [CVE-2017-7462](https://cve.now/CVE-2017-7462.md): Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web direc (no CVSS)
- [CVE-2016-10259](https://cve.now/CVE-2016-10259.md): Symantec SSL Visibility (SSLV) 3.8.4FC, 3.9, 3.10 before 3.10.4.1, and 3.11 before 3.11.3.1 is susceptible to a denial-of-service vulnerabil (no CVSS, Symantec SSL Visibility)
- [CVE-2016-6811](https://cve.now/CVE-2016-6811.md): In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. (no CVSS, org.apache.hadoop:hadoop-common)
- [CVE-2016-7467](https://cve.now/CVE-2016-7467.md): The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider w (no CVSS, F5 Networks F5 BIG-IP APM)
- [CVE-2017-7621](https://cve.now/CVE-2017-7621.md): Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt. (no CVSS)
- [CVE-2016-1908](https://cve.now/CVE-2016-1908.md): The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for acc (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.