CVEs published April 13, 2017
77 CVEs were published on April 13, 2017: 0 critical, 2 high.
- Published
- 77
- Critical
- 0
- High
- 2
- Medium
- 4
- Low
- 1
- Unrated
- 70
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…
- 8
- salt
- 2
- concrete5/concrete5
- 1
- ember-source
- 1
- io.netty:netty-handler
- 1
- org.eclipse.jetty:jetty-server
- 1
High 2
- CVE-2016-8723An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmwareMoxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…
- CVE-2016-8726An exploitable null pointer dereference vulnerability exists in the Web Application /forms/web_runScript iw_filename functionality of Moxa AMoxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…
Medium, low and unrated 75
- CVE-2016-6818SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive informatio
- CVE-2016-8712An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1.Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…
- CVE-2016-8720An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point rMoxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…
- CVE-2016-8722An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Series Industrial IEEE 802Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…
- CVE-2016-8724An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless Access Point runningMoxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…
- CVE-2016-8725An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…
- CVE-2016-8727An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point.Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…
- CVE-2012-1301The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter.
- CVE-2013-6648SkRegion::setPath in Skia allows remote attackers to cause a denial of service (crash).
- CVE-2013-6662Google Chrome caches TLS sessions before certificate validation occurs.
- CVE-2014-3887Cross-site scripting (XSS) vulnerability in I-O DATA DEVICE RockDisk with firmware before 1.05e1-2.0.5 allows remote authenticated users to
- CVE-2015-2947KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic.
- CVE-2015-4646(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denia
- CVE-2015-8345The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via
- CVE-2015-8567Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).
- CVE-2015-8619The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash)
- CVE-2016-1155HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary sc
- CVE-2016-4898The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspec
- CVE-2016-4899The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspec
- CVE-2016-7834SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, S
- CVE-2017-7725concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on instconcrete5/concrete5
- CVE-2015-8780Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury.
- CVE-2016-2036The getURL function in drivers/secfilter/urlparser.c in secfilter in the Samsung kernel for Android on SM-N9005 build N9005XXUGBOB6 (Note 3)
- CVE-2016-2565Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to read sent e-mail messages, aka SVE-2015-5081.
- CVE-2016-2566Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices has SQL injection, aka SVE-2015-5081.
- CVE-2016-2567secfilter in the Samsung kernel for Android on SM-N9005 build N9005XXUGBOB6 (Note 3) and SM-G920F build G920FXXU2COH2 (Galaxy S6) devices al
- CVE-2016-4030Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini)
- CVE-2016-4031Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini)
- CVE-2016-4032Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini)
- CVE-2017-7854The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read
- CVE-2010-1816Buffer overflow in ImageIO in Apple Mac OS X 10.6 through 10.6.3 and Mac OS X Server 10.6 through 10.6.3 allows remote attackers to execute
- CVE-2010-1821Apple Mac OS X 10.6 through 10.6.3 and Mac OS X Server 10.6 through 10.6.3 allows local users to obtain system privileges.
- CVE-2014-7920mediaserver in Android 2.2 through 5.x before 5.1 allows attackers to gain privileges.
- CVE-2014-7921mediaserver in Android 4.0.3 through 5.x before 5.1 allows attackers to gain privileges.
- CVE-2016-10324In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osippars
- CVE-2016-10325In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the _osip_message_to_str() function defined in
- CVE-2016-10326In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function defined in osip
- CVE-2017-7853In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function de
- CVE-2012-6697InspIRCd before 2.0.7 allows remote attackers to cause a denial of service (infinite loop).
- CVE-2014-2710Multiple cross-site scripting (XSS) vulnerabilities in Oliver (formerly Webshare) 1.3.1 and earlier allow remote attackers to inject arbitra
- CVE-2015-1838modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.salt
- CVE-2015-1839modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.salt
- CVE-2015-6674Buffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid.
- CVE-2015-7565Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12ember-source
- CVE-2015-7740Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B851 and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of
- CVE-2015-8107Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code.
- CVE-2015-8223Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of
- CVE-2015-8270The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer derefere
- CVE-2015-8271The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.
- CVE-2015-8272RTMPDump 2.4 allows remote attackers to trigger a denial of service (NULL pointer dereference and process crash).
- CVE-2015-8282SeaWell Networks Spectrum SDC 02.05.00 has a default password of "admin" for the "admin" account.
- CVE-2015-8283Directory traversal vulnerability in configure_manage.php in SeaWell Networks Spectrum SDC 02.05.00.
- CVE-2015-8284SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions.
- CVE-2015-8864Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrar
- CVE-2016-10117Firejail does not restrict access to --tmpfs, which allows local users to gain privileges, as demonstrated by mounting over /etc.
- CVE-2016-10118Firejail allows local users to truncate /etc/resolv.conf via a chroot command to /.
- CVE-2016-10119Firejail uses 0777 permissions when mounting /tmp, which allows local users to gain privileges.
- CVE-2016-10120Firejail uses 0777 permissions when mounting (1) /dev, (2) /dev/shm, (3) /var/tmp, or (4) /var/lock, which allows local users to gain privil
- CVE-2016-10121Firejail uses weak permissions for /dev/shm/firejail and possibly other files, which allows local users to gain privileges.
- CVE-2016-10122Firejail does not properly clean environment variables, which allows local users to gain privileges.
- CVE-2016-10123Firejail allows --chroot when seccomp is not supported, which might allow local users to gain privileges.
- CVE-2016-1132Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates.
- CVE-2016-1914Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 (BES12) Self-Ser
- CVE-2016-1915Multiple cross-site scripting (XSS) vulnerabilities in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4 allow remote attacke
- CVE-2016-2104Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via
- CVE-2016-2555SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands v
- CVE-2016-3106Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.
- CVE-2016-4068Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrar
- CVE-2016-4800The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protorg.eclipse.jetty:jetty-server
- CVE-2016-4970handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of io.netty:netty-handler
- CVE-2016-6143SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note
- CVE-2017-7219A heap overflow vulnerability in Citrix NetScaler Gateway versions 10.1 before 135.8/135.12, 10.5 before 65.11, 11.0 before 70.12, and 11.1
- CVE-2017-7626The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php (n_art,type in GET Method).
- CVE-2017-7627The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php (there is a missing _JEXEC check).
- CVE-2017-7628The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php (attacker must use search_cats variable in POST metho