CVEs published April 21, 2017
47 CVEs were published on April 21, 2017: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 47
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 46
- Now in CISA KEV
- 1
- Fix available
- 3
Most affected products
- manila-ui
- 1
- org.springframework.amqp:spring-amqp
- 1
- shopware/shopware
- 1
Critical 1
Medium, low and unrated 46
- CVE-2016-1186Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.
- CVE-2016-1187Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.
- CVE-2016-1198Photopt for Android before 2.0.1 does not verify SSL certificates.
- CVE-2016-1210The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle
- CVE-2016-1221Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv
- CVE-2016-1518The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-t
- CVE-2016-1519The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, w
- CVE-2016-1520The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-th
- CVE-2016-1560ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the
- CVE-2016-1561ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote atta
- CVE-2016-2173org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.org.springframework.amqp:spring-amqp
- CVE-2016-2347Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arb
- CVE-2016-2433The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers to execute arbitrary c
- CVE-2016-3067Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.
- CVE-2016-3109The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.shopware/shopware
- CVE-2016-3702Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.
- CVE-2016-5168Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive informatio
- CVE-2016-5399The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a deni
- CVE-2016-9954The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a
- CVE-2017-8050Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin passwo
- CVE-2017-8051Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI.
- CVE-2017-7994The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL p
- CVE-2016-0720Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.
- CVE-2016-0721Session fixation vulnerability in pcsd in pcs before 0.9.157.
- CVE-2016-10091Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to t
- CVE-2016-1556Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND930 before 2.0.11 allo
- CVE-2016-1557Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP.
- CVE-2016-1558Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver.
- CVE-2016-1559D-Link DAP-1353 H/W vers.
- CVE-2016-6519Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to injemanila-ui
- CVE-2016-0833Android allows users to cause a denial of service.
- CVE-2016-1148Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.
- CVE-2016-1184Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.
- CVE-2016-1194Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service.
- CVE-2016-4829DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.
- CVE-2016-4830Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.
- CVE-2016-4832WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.
- CVE-2016-4840Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates.
- CVE-2016-4841Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.
- CVE-2016-4846Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2.
- CVE-2017-7992Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentica
- CVE-2016-4075Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank
- CVE-2017-7220OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE
- CVE-2017-7409Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011
- CVE-2017-7951WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context.
- CVE-2017-7990The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert