# CVEs published 2017-04-14

60 CVEs were published on April 14, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-0727](https://cve.now/CVE-2016-0727.md): The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ub (no CVSS)
- [CVE-2016-1713](https://cve.now/CVE-2016-1713.md): Unrestricted file upload vulnerability in the Settings\_Vtiger\_CompanyDetailsSave\_Action class in modules/Settings/Vtiger/actions/CompanyDeta (no CVSS)
- [CVE-2016-3104](https://cve.now/CVE-2016-3104.md): mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and proce (no CVSS)
- [CVE-2016-4455](https://cve.now/CVE-2016-4455.md): The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manag (no CVSS)
- [CVE-2016-4875](https://cve.now/CVE-2016-4875.md): Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0. (no CVSS)
- [CVE-2016-4888](https://cve.now/CVE-2016-4888.md): Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2016-4889](https://cve.now/CVE-2016-4889.md): ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to re (no CVSS)
- [CVE-2016-4890](https://cve.now/CVE-2016-4890.md): ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain (no CVSS)
- [CVE-2016-5309](https://cve.now/CVE-2016-5309.md): The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Secur (no CVSS)
- [CVE-2016-5310](https://cve.now/CVE-2016-5310.md): The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Secur (no CVSS)
- [CVE-2016-5312](https://cve.now/CVE-2016-5312.md): Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to (no CVSS)
- [CVE-2016-6299](https://cve.now/CVE-2016-6299.md): The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec (no CVSS)
- [CVE-2016-6489](https://cve.now/CVE-2016-6489.md): The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack. (no CVSS)
- [CVE-2016-7032](https://cve.now/CVE-2016-7032.md): sudo\_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that (no CVSS)
- [CVE-2016-7051](https://cve.now/CVE-2016-7051.md): XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers t (no CVSS, com.fasterxml.jackson.dataformat:jackson-dataformat-xml)
- [CVE-2016-7060](https://cve.now/CVE-2016-7060.md): The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physically proximate attacker (no CVSS)
- [CVE-2016-8602](https://cve.now/CVE-2016-8602.md): The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) (no CVSS)
- [CVE-2017-6554](https://cve.now/CVE-2017-6554.md): pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to write to arbitrary fil (no CVSS)
- [CVE-2017-7188](https://cve.now/CVE-2017-7188.md): Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl param (no CVSS)
- [CVE-2017-7357](https://cve.now/CVE-2017-7357.md): Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by import (no CVSS)
- [CVE-2017-7690](https://cve.now/CVE-2017-7690.md): Proxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by replacing the KLoader binary with a Trojan horse p (no CVSS)
- [CVE-2017-7696](https://cve.now/CVE-2017-7696.md): SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large va (no CVSS)
- [CVE-2017-7717](https://cve.now/CVE-2017-7717.md): SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authentica (no CVSS)
- [CVE-2017-7871](https://cve.now/CVE-2017-7871.md): trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter). (no CVSS)
- [CVE-2017-7875](https://cve.now/CVE-2017-7875.md): In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-bound (no CVSS)
- [CVE-2017-7877](https://cve.now/CVE-2017-7877.md): CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations. (no CVSS)
- [CVE-2017-7878](https://cve.now/CVE-2017-7878.md): SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database. (no CVSS)
- [CVE-2017-7879](https://cve.now/CVE-2017-7879.md): SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database. (no CVSS)
- [CVE-2015-6567](https://cve.now/CVE-2015-6567.md): Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file\_manager/browse/ (aka the filemanage (no CVSS)
- [CVE-2015-6568](https://cve.now/CVE-2015-6568.md): Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file\_manager/browse/ (aka the filemanage (no CVSS)
- [CVE-2016-8925](https://cve.now/CVE-2016-8925.md): IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to include arbitrary files which could allow (no CVSS, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2016-8926](https://cve.now/CVE-2016-8926.md): IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or data that is restric (no CVSS, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2016-8927](https://cve.now/CVE-2016-8927.md): IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site scripting. (no CVSS, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2017-1152](https://cve.now/CVE-2017-1152.md): IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obta (no CVSS, IBM Financial Transaction Manager)
- [CVE-2017-1205](https://cve.now/CVE-2017-1205.md): IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges and obtain root acces (no CVSS, IBM Spectrum LSF)
- [CVE-2015-8356](https://cve.now/CVE-2015-8356.md): Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbi (no CVSS)
- [CVE-2017-7217](https://cve.now/CVE-2017-7217.md): The Management Web Interface in Palo Alto Networks PAN-OS before 7.0.14 and 7.1.x before 7.1.9 allows remote attackers to write to export fi (no CVSS)
- [CVE-2017-7218](https://cve.now/CVE-2017-7218.md): The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to gain privileges via unspecified (no CVSS)
- [CVE-2017-7408](https://cve.now/CVE-2017-7408.md): Palo Alto Networks Traps ESM Console before 3.4.4 allows attackers to cause a denial of service by leveraging improper validation of request (no CVSS)
- [CVE-2017-7455](https://cve.now/CVE-2017-7455.md): Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control. (no CVSS)
- [CVE-2017-7456](https://cve.now/CVE-2017-7456.md): Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credent (no CVSS)
- [CVE-2017-7457](https://cve.now/CVE-2017-7457.md): XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure. (no CVSS)
- [CVE-2017-7643](https://cve.now/CVE-2017-7643.md): Proxifier for Mac before 2.19 allows local users to gain privileges via the first parameter to the KLoader setuid program. (no CVSS)
- [CVE-2016-10327](https://cve.now/CVE-2016-10327.md): LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF func (no CVSS)
- [CVE-2016-10328](https://cve.now/CVE-2016-10328.md): FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff\_parser\_run function in cff (no CVSS)
- [CVE-2017-7856](https://cve.now/CVE-2017-7856.md): LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 fun (no CVSS)
- [CVE-2017-7857](https://cve.now/CVE-2017-7857.md): FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT\_Get\_MM\_Var function in true (no CVSS)
- [CVE-2017-7858](https://cve.now/CVE-2017-7858.md): FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT\_Get\_MM\_Var function in truetype/ttgxvar.c and the sfnt\_init\_face f (no CVSS)
- [CVE-2017-7859](https://cve.now/CVE-2017-7859.md): FFmpeg before 2017-03-05 has an out-of-bounds write caused by a heap-based buffer overflow related to the ff\_h264\_slice\_context\_init functio (no CVSS)
- [CVE-2017-7860](https://cve.now/CVE-2017-7860.md): Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse\_unix function in core/e (no CVSS)
- [CVE-2017-7861](https://cve.now/CVE-2017-7861.md): Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr\_free function in core/lib/support/alloc.c. (no CVSS)
- [CVE-2017-7862](https://cve.now/CVE-2017-7862.md): FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode\_frame function in libavcode (no CVSS)
- [CVE-2017-7863](https://cve.now/CVE-2017-7863.md): FFmpeg before 2017-02-04 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode\_frame\_common function in li (no CVSS)
- [CVE-2017-7864](https://cve.now/CVE-2017-7864.md): FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt\_size\_reset function in true (no CVSS)
- [CVE-2017-7865](https://cve.now/CVE-2017-7865.md): FFmpeg before 2017-01-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo\_decode\_block\_opcode\_0xA fu (no CVSS)
- [CVE-2017-7866](https://cve.now/CVE-2017-7866.md): FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode\_zbuf function in libavcode (no CVSS)
- [CVE-2017-7867](https://cve.now/CVE-2017-7867.md): International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow rel (no CVSS)
- [CVE-2017-7868](https://cve.now/CVE-2017-7868.md): International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow rel (no CVSS)
- [CVE-2017-7869](https://cve.now/CVE-2017-7869.md): GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk\_pkt\_read (no CVSS)
- [CVE-2017-7870](https://cve.now/CVE-2017-7870.md): LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert functi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.