# CVEs published 2017-04-20

101 CVEs were published on April 20, 2017: 1 critical, 1 high. Days are UTC.

- [CVE-2016-6368](https://cve.now/CVE-2016-6368.md): A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software co (no CVSS, Cisco Firepower Detection Engine)
- [CVE-2017-3793](https://cve.now/CVE-2017-3793.md): A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco Fi (no CVSS, Cisco ASA Software and Cisco FTD Software)
- [CVE-2017-3808](https://cve.now/CVE-2017-3808.md): A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) c (no CVSS, Cisco Unified Communications Manager)
- [CVE-2017-3860](https://cve.now/CVE-2017-3860.md): Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow (no CVSS, Cisco IOS and IOS XE)
- [CVE-2017-3861](https://cve.now/CVE-2017-3861.md): Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow (no CVSS, Cisco IOS and IOS XE)
- [CVE-2017-3862](https://cve.now/CVE-2017-3862.md): Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow (no CVSS, Cisco IOS and IOS XE)
- [CVE-2017-3863](https://cve.now/CVE-2017-3863.md): Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow (no CVSS, Cisco IOS and IOS XE)
- [CVE-2017-4969](https://cve.now/CVE-2017-4969.md): The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quota (no CVSS, Cloud Foundry Cloud Controller cf-release versions prior to)
- [CVE-2017-6607](https://cve.now/CVE-2017-6607.md): A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload (no CVSS, Cisco ASA Software)
- [CVE-2017-6608](https://cve.now/CVE-2017-6608.md): A vulnerability in the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) code of Cisco ASA Software could allow an unauthenticat (no CVSS, Cisco ASA Software)
- [CVE-2017-6609](https://cve.now/CVE-2017-6609.md): A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected syst (no CVSS, Cisco ASA Software)
- [CVE-2017-6610](https://cve.now/CVE-2017-6610.md): A vulnerability in the Internet Key Exchange Version 1 (IKEv1) XAUTH code of Cisco ASA Software could allow an authenticated, remote attacke (no CVSS, Cisco ASA Software)
- [CVE-2017-6611](https://cve.now/CVE-2017-6611.md): A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a (no CVSS, Cisco Prime Infrastructure)
- [CVE-2017-6613](https://cve.now/CVE-2017-6613.md): A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause (no CVSS, Cisco Prime Network Registrar)
- [CVE-2017-6614](https://cve.now/CVE-2017-6614.md): A vulnerability in the file-download feature of the web user interface for Cisco FindIT Network Probe Software 1.0.0 could allow an authenti (no CVSS, Cisco FindIT)
- [CVE-2017-6615](https://cve.now/CVE-2017-6615.md): A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote attacke (no CVSS, Cisco IOS XE Software)
- [CVE-2017-6616](https://cve.now/CVE-2017-6616.md): A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker t (no CVSS, Cisco Integrated Management Controller)
- [CVE-2017-6617](https://cve.now/CVE-2017-6617.md): A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) (no CVSS, Cisco Integrated Management Controller)
- [CVE-2017-6618](https://cve.now/CVE-2017-6618.md): A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker t (no CVSS, Cisco Integrated Management Controller)
- [CVE-2017-6619](https://cve.now/CVE-2017-6619.md): A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker t (no CVSS, Cisco Integrated Management Controller)
- [CVE-2015-8285](https://cve.now/CVE-2015-8285.md): The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service. (no CVSS)
- [CVE-2016-1161](https://cve.now/CVE-2016-1161.md): Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500). (no CVSS)
- [CVE-2016-3729](https://cve.now/CVE-2016-3729.md): The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote auth (no CVSS, moodle/moodle)
- [CVE-2016-3731](https://cve.now/CVE-2016-3731.md): Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum d (no CVSS)
- [CVE-2016-3732](https://cve.now/CVE-2016-3732.md): The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earl (no CVSS, moodle/moodle)
- [CVE-2016-3733](https://cve.now/CVE-2016-3733.md): The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows rem (no CVSS, moodle/moodle)
- [CVE-2016-3734](https://cve.now/CVE-2016-3734.md): Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 thr (no CVSS, moodle/moodle)
- [CVE-2016-5401](https://cve.now/CVE-2016-5401.md): Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of use (no CVSS)
- [CVE-2016-8923](https://cve.now/CVE-2016-8923.md): IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive infor (no CVSS, IBM Curam Social Program Management)
- [CVE-2016-9978](https://cve.now/CVE-2016-9978.md): IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information. (no CVSS, IBM Curam Social Program Management)
- [CVE-2016-9979](https://cve.now/CVE-2016-9979.md): IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. (no CVSS, IBM Curam Social Program Management)
- [CVE-2016-9980](https://cve.now/CVE-2016-9980.md): IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. (no CVSS, IBM Curam Social Program Management)
- [CVE-2017-1122](https://cve.now/CVE-2017-1122.md): IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary comm (no CVSS, IBM Security Guardium)
- [CVE-2017-5156](https://cve.now/CVE-2017-5156.md): A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. (no CVSS, Schneider Electric Wonderware InTouch Access Anywhere)
- [CVE-2017-5158](https://cve.now/CVE-2017-5158.md): An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. (no CVSS, Schneider Electric Wonderware InTouch Access Anywhere)
- [CVE-2017-5160](https://cve.now/CVE-2017-5160.md): An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. (no CVSS, Schneider Electric Wonderware InTouch Access Anywhere)
- [CVE-2015-8957](https://cve.now/CVE-2015-8957.md): Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SU (no CVSS)
- [CVE-2015-8958](https://cve.now/CVE-2015-8958.md): coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application cra (no CVSS)
- [CVE-2015-8959](https://cve.now/CVE-2015-8959.md): coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS fil (no CVSS)
- [CVE-2016-1213](https://cve.now/CVE-2016-1213.md): The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites. (no CVSS)
- [CVE-2016-1214](https://cve.now/CVE-2016-1214.md): Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1215](https://cve.now/CVE-2016-1215.md): Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1216](https://cve.now/CVE-2016-1216.md): Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1217](https://cve.now/CVE-2016-1217.md): Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1218](https://cve.now/CVE-2016-1218.md): SQL injection vulnerability in Cybozu Garoon before 4.2.2. (no CVSS)
- [CVE-2016-1220](https://cve.now/CVE-2016-1220.md): Cybozu Garoon before 4.2.2 does not properly restrict access. (no CVSS)
- [CVE-2016-4818](https://cve.now/CVE-2016-4818.md): DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and e (no CVSS)
- [CVE-2016-4842](https://cve.now/CVE-2016-4842.md): Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read. (no CVSS)
- [CVE-2016-4843](https://cve.now/CVE-2016-4843.md): Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information. (no CVSS)
- [CVE-2016-4844](https://cve.now/CVE-2016-4844.md): Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks. (no CVSS)
- [CVE-2016-4850](https://cve.now/CVE-2016-4850.md): LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code. (no CVSS)
- [CVE-2016-4862](https://cve.now/CVE-2016-4862.md): Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated user (no CVSS)
- [CVE-2016-5010](https://cve.now/CVE-2016-5010.md): coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF fil (no CVSS)
- [CVE-2016-7513](https://cve.now/CVE-2016-7513.md): Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via unspecified (no CVSS)
- [CVE-2016-7514](https://cve.now/CVE-2016-7514.md): The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) v (no CVSS)
- [CVE-2016-7516](https://cve.now/CVE-2016-7516.md): The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a c (no CVSS)
- [CVE-2016-7517](https://cve.now/CVE-2016-7517.md): The EncodeImage function in coders/pict.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cra (no CVSS)
- [CVE-2016-7518](https://cve.now/CVE-2016-7518.md): The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cra (no CVSS)
- [CVE-2016-7520](https://cve.now/CVE-2016-7520.md): Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cr (no CVSS)
- [CVE-2016-7521](https://cve.now/CVE-2016-7521.md): Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cr (no CVSS)
- [CVE-2016-7525](https://cve.now/CVE-2016-7525.md): Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a cr (no CVSS)
- [CVE-2016-7526](https://cve.now/CVE-2016-7526.md): coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. (no CVSS)
- [CVE-2016-7527](https://cve.now/CVE-2016-7527.md): coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. (no CVSS)
- [CVE-2016-7530](https://cve.now/CVE-2016-7530.md): The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds write) (no CVSS)
- [CVE-2016-7532](https://cve.now/CVE-2016-7532.md): coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file. (no CVSS)
- [CVE-2016-7534](https://cve.now/CVE-2016-7534.md): The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file. (no CVSS)
- [CVE-2016-7535](https://cve.now/CVE-2016-7535.md): coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PSD file. (no CVSS)
- [CVE-2016-7536](https://cve.now/CVE-2016-7536.md): magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted profile. (no CVSS)
- [CVE-2016-7538](https://cve.now/CVE-2016-7538.md): coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. (no CVSS)
- [CVE-2016-7540](https://cve.now/CVE-2016-7540.md): coders/rgf.c in ImageMagick before 6.9.4-10 allows remote attackers to cause a denial of service (assertion failure) by converting an image (no CVSS)
- [CVE-2016-8721](https://cve.now/CVE-2016-8721.md): An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Point (CVSS 9.1, Moxa AWK-3131A WAP)
- [CVE-2017-2784](https://cve.now/CVE-2017-2784.md): An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2 (CVSS 8.1, ARM mbed TLS)
- [CVE-2017-2806](https://cve.now/CVE-2017-2806.md): An exploitable arbitrary read exists in the XLS parsing of the Lexmark Perspective Document Filters conversion functionality. (CVSS 4.3, Lexmark Perceptive Document Filters)
- [CVE-2017-5183](https://cve.now/CVE-2017-5183.md): NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field (no CVSS, Identity Server)
- [CVE-2016-1219](https://cve.now/CVE-2016-1219.md): Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use. (no CVSS)
- [CVE-2016-4293](https://cve.now/CVE-2016-4293.md): Multiple heap-based buffer overflows in the (1) CBookBase::SetDefTableStyle and (2) CBookBase::SetDefPivotStyle functions in Hancom Office 2 (no CVSS)
- [CVE-2016-4650](https://cve.now/CVE-2016-4650.md): Heap-based buffer overflow in IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to execute (no CVSS)
- [CVE-2016-4847](https://cve.now/CVE-2016-4847.md): Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2016-4849](https://cve.now/CVE-2016-4849.md): Multiple cross-site scripting (XSS) vulnerabilities in Geeklog IVYWE edition 2.1.1 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2016-5409](https://cve.now/CVE-2016-5409.md): Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for re (no CVSS)
- [CVE-2016-5760](https://cve.now/CVE-2016-5760.md): Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch (no CVSS)
- [CVE-2016-5761](https://cve.now/CVE-2016-5761.md): Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allows remote attackers to inject arb (no CVSS)
- [CVE-2016-5762](https://cve.now/CVE-2016-5762.md): Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to exec (no CVSS)
- [CVE-2016-6331](https://cve.now/CVE-2016-6331.md): ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title re (no CVSS)
- [CVE-2016-6332](https://cve.now/CVE-2016-6332.md): MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers t (no CVSS)
- [CVE-2016-6333](https://cve.now/CVE-2016-6333.md): Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27 (no CVSS)
- [CVE-2016-6334](https://cve.now/CVE-2016-6334.md): Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and (no CVSS)
- [CVE-2016-6335](https://cve.now/CVE-2016-6335.md): MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which (no CVSS)
- [CVE-2016-6336](https://cve.now/CVE-2016-6336.md): MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypa (no CVSS)
- [CVE-2016-6337](https://cve.now/CVE-2016-6337.md): MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserG (no CVSS)
- [CVE-2016-6338](https://cve.now/CVE-2016-6338.md): ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proxi (no CVSS)
- [CVE-2016-6341](https://cve.now/CVE-2016-6341.md): oVirt Engine before 4.0.3 does not include DWH\_DB\_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sens (no CVSS)
- [CVE-2016-6347](https://cve.now/CVE-2016-6347.md): Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script (no CVSS, org.jboss.resteasy:resteasy-client)
- [CVE-2017-7718](https://cve.now/CVE-2017-7718.md): hw/display/cirrus\_vga\_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds (no CVSS)
- [CVE-2017-5190](https://cve.now/CVE-2017-5190.md): NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a (no CVSS, NAM Identity Server and SAML2 Service Provider)
- [CVE-2017-7692](https://cve.now/CVE-2017-7692.md): SquirrelMail 1.4.22 (and other versions before 20170427\_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file th (no CVSS)
- [CVE-2017-7982](https://cve.now/CVE-2017-7982.md): Integer overflow in the plist\_from\_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause (no CVSS)
- [CVE-2017-6919](https://cve.now/CVE-2017-6919.md): Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is (no CVSS, Drupal · drupal/core +1)
- [CVE-2017-7282](https://cve.now/CVE-2017-7282.md): An issue was discovered in Unitrends Enterprise Backup before 9.1.1. (no CVSS)
- [CVE-2017-7283](https://cve.now/CVE-2017-7283.md): An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename (no CVSS)
- [CVE-2017-7938](https://cve.now/CVE-2017-7938.md): Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of servi (CVSS 6.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.