# CVEs published 2017-04-13

77 CVEs were published on April 13, 2017: 0 critical, 2 high. Days are UTC.

- [CVE-2016-6818](https://cve.now/CVE-2016-6818.md): SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive informatio (no CVSS)
- [CVE-2016-8712](https://cve.now/CVE-2016-8712.md): An exploitable nonce reuse vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless AP running firmware 1.1. (CVSS 5.9, Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…)
- [CVE-2016-8720](https://cve.now/CVE-2016-8720.md): An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point r (CVSS 3.1, Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…)
- [CVE-2016-8722](https://cve.now/CVE-2016-8722.md): An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Series Industrial IEEE 802 (CVSS 5.3, Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…)
- [CVE-2016-8723](https://cve.now/CVE-2016-8723.md): An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware (CVSS 7.5, Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…)
- [CVE-2016-8724](https://cve.now/CVE-2016-8724.md): An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless Access Point running (CVSS 5.3, Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…)
- [CVE-2016-8725](https://cve.now/CVE-2016-8725.md): An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point (CVSS 5.3, Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…)
- [CVE-2016-8726](https://cve.now/CVE-2016-8726.md): An exploitable null pointer dereference vulnerability exists in the Web Application /forms/web\_runScript iw\_filename functionality of Moxa A (CVSS 7.5, Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…)
- [CVE-2016-8727](https://cve.now/CVE-2016-8727.md): An exploitable information disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point. (no CVSS, Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireles…)
- [CVE-2012-1301](https://cve.now/CVE-2012-1301.md): The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter. (no CVSS)
- [CVE-2013-6648](https://cve.now/CVE-2013-6648.md): SkRegion::setPath in Skia allows remote attackers to cause a denial of service (crash). (no CVSS)
- [CVE-2013-6662](https://cve.now/CVE-2013-6662.md): Google Chrome caches TLS sessions before certificate validation occurs. (no CVSS)
- [CVE-2014-3887](https://cve.now/CVE-2014-3887.md): Cross-site scripting (XSS) vulnerability in I-O DATA DEVICE RockDisk with firmware before 1.05e1-2.0.5 allows remote authenticated users to (no CVSS)
- [CVE-2015-2947](https://cve.now/CVE-2015-2947.md): KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic. (no CVSS)
- [CVE-2015-4646](https://cve.now/CVE-2015-4646.md): (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denia (no CVSS)
- [CVE-2015-8345](https://cve.now/CVE-2015-8345.md): The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via (no CVSS)
- [CVE-2015-8567](https://cve.now/CVE-2015-8567.md): Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption). (no CVSS)
- [CVE-2015-8619](https://cve.now/CVE-2015-8619.md): The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash) (no CVSS)
- [CVE-2016-1155](https://cve.now/CVE-2016-1155.md): HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary sc (no CVSS)
- [CVE-2016-4898](https://cve.now/CVE-2016-4898.md): The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspec (no CVSS)
- [CVE-2016-4899](https://cve.now/CVE-2016-4899.md): The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspec (no CVSS)
- [CVE-2016-7834](https://cve.now/CVE-2016-7834.md): SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, S (no CVSS)
- [CVE-2017-7725](https://cve.now/CVE-2017-7725.md): concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on inst (no CVSS, concrete5/concrete5)
- [CVE-2015-8780](https://cve.now/CVE-2015-8780.md): Samsung wssyncmlnps before 2015-10-31 allows directory traversal in a Kies restore, aka ZipFury. (no CVSS)
- [CVE-2016-2036](https://cve.now/CVE-2016-2036.md): The getURL function in drivers/secfilter/urlparser.c in secfilter in the Samsung kernel for Android on SM-N9005 build N9005XXUGBOB6 (Note 3) (no CVSS)
- [CVE-2016-2565](https://cve.now/CVE-2016-2565.md): Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to read sent e-mail messages, aka SVE-2015-5081. (no CVSS)
- [CVE-2016-2566](https://cve.now/CVE-2016-2566.md): Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices has SQL injection, aka SVE-2015-5081. (no CVSS)
- [CVE-2016-2567](https://cve.now/CVE-2016-2567.md): secfilter in the Samsung kernel for Android on SM-N9005 build N9005XXUGBOB6 (Note 3) and SM-G920F build G920FXXU2COH2 (Galaxy S6) devices al (no CVSS)
- [CVE-2016-4030](https://cve.now/CVE-2016-4030.md): Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini) (no CVSS)
- [CVE-2016-4031](https://cve.now/CVE-2016-4031.md): Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini) (no CVSS)
- [CVE-2016-4032](https://cve.now/CVE-2016-4032.md): Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini) (no CVSS)
- [CVE-2017-7854](https://cve.now/CVE-2017-7854.md): The consume\_init\_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read (no CVSS)
- [CVE-2010-1816](https://cve.now/CVE-2010-1816.md): Buffer overflow in ImageIO in Apple Mac OS X 10.6 through 10.6.3 and Mac OS X Server 10.6 through 10.6.3 allows remote attackers to execute (no CVSS)
- [CVE-2010-1821](https://cve.now/CVE-2010-1821.md): Apple Mac OS X 10.6 through 10.6.3 and Mac OS X Server 10.6 through 10.6.3 allows local users to obtain system privileges. (no CVSS)
- [CVE-2014-7920](https://cve.now/CVE-2014-7920.md): mediaserver in Android 2.2 through 5.x before 5.1 allows attackers to gain privileges. (no CVSS)
- [CVE-2014-7921](https://cve.now/CVE-2014-7921.md): mediaserver in Android 4.0.3 through 5.x before 5.1 allows attackers to gain privileges. (no CVSS)
- [CVE-2016-10324](https://cve.now/CVE-2016-10324.md): In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip\_clrncpy() function defined in osippars (no CVSS)
- [CVE-2016-10325](https://cve.now/CVE-2016-10325.md): In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the \_osip\_message\_to\_str() function defined in (no CVSS)
- [CVE-2016-10326](https://cve.now/CVE-2016-10326.md): In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip\_body\_to\_str() function defined in osip (no CVSS)
- [CVE-2017-7853](https://cve.now/CVE-2017-7853.md): In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg\_osip\_body\_parse() function de (no CVSS)
- [CVE-2012-6697](https://cve.now/CVE-2012-6697.md): InspIRCd before 2.0.7 allows remote attackers to cause a denial of service (infinite loop). (no CVSS)
- [CVE-2014-2710](https://cve.now/CVE-2014-2710.md): Multiple cross-site scripting (XSS) vulnerabilities in Oliver (formerly Webshare) 1.3.1 and earlier allow remote attackers to inject arbitra (no CVSS)
- [CVE-2015-1838](https://cve.now/CVE-2015-1838.md): modules/serverdensity\_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. (no CVSS, salt)
- [CVE-2015-1839](https://cve.now/CVE-2015-1839.md): modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. (no CVSS, salt)
- [CVE-2015-6674](https://cve.now/CVE-2015-6674.md): Buffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid. (no CVSS)
- [CVE-2015-7565](https://cve.now/CVE-2015-7565.md): Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12 (no CVSS, ember-source)
- [CVE-2015-7740](https://cve.now/CVE-2015-7740.md): Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B851 and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of (no CVSS)
- [CVE-2015-8107](https://cve.now/CVE-2015-8107.md): Format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2015-8223](https://cve.now/CVE-2015-8223.md): Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of (no CVSS)
- [CVE-2015-8270](https://cve.now/CVE-2015-8270.md): The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer derefere (no CVSS)
- [CVE-2015-8271](https://cve.now/CVE-2015-8271.md): The AMF3CD\_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code. (no CVSS)
- [CVE-2015-8272](https://cve.now/CVE-2015-8272.md): RTMPDump 2.4 allows remote attackers to trigger a denial of service (NULL pointer dereference and process crash). (no CVSS)
- [CVE-2015-8282](https://cve.now/CVE-2015-8282.md): SeaWell Networks Spectrum SDC 02.05.00 has a default password of "admin" for the "admin" account. (no CVSS)
- [CVE-2015-8283](https://cve.now/CVE-2015-8283.md): Directory traversal vulnerability in configure\_manage.php in SeaWell Networks Spectrum SDC 02.05.00. (no CVSS)
- [CVE-2015-8284](https://cve.now/CVE-2015-8284.md): SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions. (no CVSS)
- [CVE-2015-8864](https://cve.now/CVE-2015-8864.md): Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2016-10117](https://cve.now/CVE-2016-10117.md): Firejail does not restrict access to --tmpfs, which allows local users to gain privileges, as demonstrated by mounting over /etc. (no CVSS)
- [CVE-2016-10118](https://cve.now/CVE-2016-10118.md): Firejail allows local users to truncate /etc/resolv.conf via a chroot command to /. (no CVSS)
- [CVE-2016-10119](https://cve.now/CVE-2016-10119.md): Firejail uses 0777 permissions when mounting /tmp, which allows local users to gain privileges. (no CVSS)
- [CVE-2016-10120](https://cve.now/CVE-2016-10120.md): Firejail uses 0777 permissions when mounting (1) /dev, (2) /dev/shm, (3) /var/tmp, or (4) /var/lock, which allows local users to gain privil (no CVSS)
- [CVE-2016-10121](https://cve.now/CVE-2016-10121.md): Firejail uses weak permissions for /dev/shm/firejail and possibly other files, which allows local users to gain privileges. (no CVSS)
- [CVE-2016-10122](https://cve.now/CVE-2016-10122.md): Firejail does not properly clean environment variables, which allows local users to gain privileges. (no CVSS)
- [CVE-2016-10123](https://cve.now/CVE-2016-10123.md): Firejail allows --chroot when seccomp is not supported, which might allow local users to gain privileges. (no CVSS)
- [CVE-2016-1132](https://cve.now/CVE-2016-1132.md): Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates. (no CVSS)
- [CVE-2016-1914](https://cve.now/CVE-2016-1914.md): Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 (BES12) Self-Ser (no CVSS)
- [CVE-2016-1915](https://cve.now/CVE-2016-1915.md): Multiple cross-site scripting (XSS) vulnerabilities in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4 allow remote attacke (no CVSS)
- [CVE-2016-2104](https://cve.now/CVE-2016-2104.md): Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2016-2555](https://cve.now/CVE-2016-2555.md): SQL injection vulnerability in include/lib/mysql\_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2016-3106](https://cve.now/CVE-2016-3106.md): Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner. (no CVSS)
- [CVE-2016-4068](https://cve.now/CVE-2016-4068.md): Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2016-4800](https://cve.now/CVE-2016-4800.md): The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass prot (no CVSS, org.eclipse.jetty:jetty-server)
- [CVE-2016-4970](https://cve.now/CVE-2016-4970.md): handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of (no CVSS, io.netty:netty-handler)
- [CVE-2016-6143](https://cve.now/CVE-2016-6143.md): SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note (no CVSS)
- [CVE-2017-7219](https://cve.now/CVE-2017-7219.md): A heap overflow vulnerability in Citrix NetScaler Gateway versions 10.1 before 135.8/135.12, 10.5 before 65.11, 11.0 before 70.12, and 11.1 (no CVSS)
- [CVE-2017-7626](https://cve.now/CVE-2017-7626.md): The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php (n\_art,type in GET Method). (no CVSS)
- [CVE-2017-7627](https://cve.now/CVE-2017-7627.md): The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php (there is a missing \_JEXEC check). (no CVSS)
- [CVE-2017-7628](https://cve.now/CVE-2017-7628.md): The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php (attacker must use search\_cats variable in POST metho (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.