CVEs published April 20, 2017
101 CVEs were published on April 20, 2017: 1 critical, 1 high.
- Published
- 101
- Critical
- 1
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 97
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Cisco ASA Software
- 4
- Cisco Integrated Management Controller
- 4
- Cisco IOS and IOS XE
- 4
- IBM Curam Social Program Management
- 4
- moodle/moodle
- 4
- Schneider Electric Wonderware InTouch Access Anywhere
- 3
- ARM mbed TLS
- 1
- Cisco ASA Software and Cisco FTD Software
- 1
- Cisco FindIT
- 1
- Cisco Firepower Detection Engine
- 1
Critical 1
High 1
Medium, low and unrated 99
- CVE-2016-6368A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software coCisco Firepower Detection Engine
- CVE-2017-3793A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco FiCisco ASA Software and Cisco FTD Software
- CVE-2017-3808A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) cCisco Unified Communications Manager
- CVE-2017-3860Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow Cisco IOS and IOS XE
- CVE-2017-3861Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow Cisco IOS and IOS XE
- CVE-2017-3862Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow Cisco IOS and IOS XE
- CVE-2017-3863Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow Cisco IOS and IOS XE
- CVE-2017-4969The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quotaCloud Foundry Cloud Controller cf-release versions prior to
- CVE-2017-6607A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload Cisco ASA Software
- CVE-2017-6608A vulnerability in the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) code of Cisco ASA Software could allow an unauthenticatCisco ASA Software
- CVE-2017-6609A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected systCisco ASA Software
- CVE-2017-6610A vulnerability in the Internet Key Exchange Version 1 (IKEv1) XAUTH code of Cisco ASA Software could allow an authenticated, remote attackeCisco ASA Software
- CVE-2017-6611A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a Cisco Prime Infrastructure
- CVE-2017-6613A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to causeCisco Prime Network Registrar
- CVE-2017-6614A vulnerability in the file-download feature of the web user interface for Cisco FindIT Network Probe Software 1.0.0 could allow an authentiCisco FindIT
- CVE-2017-6615A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote attackeCisco IOS XE Software
- CVE-2017-6616A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker tCisco Integrated Management Controller
- CVE-2017-6617A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) Cisco Integrated Management Controller
- CVE-2017-6618A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker tCisco Integrated Management Controller
- CVE-2017-6619A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker tCisco Integrated Management Controller
- CVE-2015-8285The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
- CVE-2016-1161Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500).
- CVE-2016-3729The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authmoodle/moodle
- CVE-2016-3731Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum d
- CVE-2016-3732The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlmoodle/moodle
- CVE-2016-3733The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remmoodle/moodle
- CVE-2016-3734Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 thrmoodle/moodle
- CVE-2016-5401Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of use
- CVE-2016-8923IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive inforIBM Curam Social Program Management
- CVE-2016-9978IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information.IBM Curam Social Program Management
- CVE-2016-9979IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting.IBM Curam Social Program Management
- CVE-2016-9980IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting.IBM Curam Social Program Management
- CVE-2017-1122IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary commIBM Security Guardium
- CVE-2017-5156A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior.Schneider Electric Wonderware InTouch Access Anywhere
- CVE-2017-5158An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior.Schneider Electric Wonderware InTouch Access Anywhere
- CVE-2017-5160An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior.Schneider Electric Wonderware InTouch Access Anywhere
- CVE-2015-8957Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SU
- CVE-2015-8958coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application cra
- CVE-2015-8959coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS fil
- CVE-2016-1213The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.
- CVE-2016-1214Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2.
- CVE-2016-1215Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2.
- CVE-2016-1216Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2.
- CVE-2016-1217Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2.
- CVE-2016-1218SQL injection vulnerability in Cybozu Garoon before 4.2.2.
- CVE-2016-1220Cybozu Garoon before 4.2.2 does not properly restrict access.
- CVE-2016-4818DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and e
- CVE-2016-4842Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read.
- CVE-2016-4843Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information.
- CVE-2016-4844Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks.
- CVE-2016-4850LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code.
- CVE-2016-4862Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated user
- CVE-2016-5010coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF fil
- CVE-2016-7513Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via unspecified
- CVE-2016-7514The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) v
- CVE-2016-7516The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a c
- CVE-2016-7517The EncodeImage function in coders/pict.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cra
- CVE-2016-7518The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cra
- CVE-2016-7520Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cr
- CVE-2016-7521Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cr
- CVE-2016-7525Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cr
- CVE-2016-7526coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
- CVE-2016-7527coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
- CVE-2016-7530The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds write)
- CVE-2016-7532coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
- CVE-2016-7534The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file.
- CVE-2016-7535coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PSD file.
- CVE-2016-7536magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted profile.
- CVE-2016-7538coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
- CVE-2016-7540coders/rgf.c in ImageMagick before 6.9.4-10 allows remote attackers to cause a denial of service (assertion failure) by converting an image
- CVE-2017-2806An exploitable arbitrary read exists in the XLS parsing of the Lexmark Perspective Document Filters conversion functionality.Lexmark Perceptive Document Filters
- CVE-2017-5183NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field Identity Server
- CVE-2016-1219Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.
- CVE-2016-4293Multiple heap-based buffer overflows in the (1) CBookBase::SetDefTableStyle and (2) CBookBase::SetDefPivotStyle functions in Hancom Office 2
- CVE-2016-4650Heap-based buffer overflow in IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to execute
- CVE-2016-4847Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web scrip
- CVE-2016-4849Multiple cross-site scripting (XSS) vulnerabilities in Geeklog IVYWE edition 2.1.1 allow remote attackers to inject arbitrary web script or
- CVE-2016-5409Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for re
- CVE-2016-5760Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch
- CVE-2016-5761Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allows remote attackers to inject arb
- CVE-2016-5762Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to exec
- CVE-2016-6331ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title re
- CVE-2016-6332MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers t
- CVE-2016-6333Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27
- CVE-2016-6334Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and
- CVE-2016-6335MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which
- CVE-2016-6336MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypa
- CVE-2016-6337MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserG
- CVE-2016-6338ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proxi
- CVE-2016-6341oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sens
- CVE-2016-6347Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web scriptorg.jboss.resteasy:resteasy-client
- CVE-2017-7718hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds
- CVE-2017-5190NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has aNAM Identity Server and SAML2 Service Provider
- CVE-2017-7692SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file th
- CVE-2017-7982Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause
- CVE-2017-6919Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module isDrupal · drupal/core +1
- CVE-2017-7282An issue was discovered in Unitrends Enterprise Backup before 9.1.1.
- CVE-2017-7283An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename
- CVE-2017-7938Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of servi