# CVEs published 2017-04-21

47 CVEs were published on April 21, 2017: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-1186](https://cve.now/CVE-2016-1186.md): Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates. (no CVSS)
- [CVE-2016-1187](https://cve.now/CVE-2016-1187.md): Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates. (no CVSS)
- [CVE-2016-1198](https://cve.now/CVE-2016-1198.md): Photopt for Android before 2.0.1 does not verify SSL certificates. (no CVSS)
- [CVE-2016-1210](https://cve.now/CVE-2016-1210.md): The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle (no CVSS)
- [CVE-2016-1221](https://cve.now/CVE-2016-1221.md): Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv (no CVSS)
- [CVE-2016-1518](https://cve.now/CVE-2016-1518.md): The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-t (no CVSS)
- [CVE-2016-1519](https://cve.now/CVE-2016-1519.md): The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, w (no CVSS)
- [CVE-2016-1520](https://cve.now/CVE-2016-1520.md): The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-th (no CVSS)
- [CVE-2016-1560](https://cve.now/CVE-2016-1560.md): ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the (no CVSS)
- [CVE-2016-1561](https://cve.now/CVE-2016-1561.md): ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized\_keys file for root, which allows remote atta (no CVSS)
- [CVE-2016-2173](https://cve.now/CVE-2016-2173.md): org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code. (no CVSS, org.springframework.amqp:spring-amqp)
- [CVE-2016-2347](https://cve.now/CVE-2016-2347.md): Integer underflow in the decode\_level3\_header function in lib/lha\_file\_header.c in Lhasa before 0.3.1 allows remote attackers to execute arb (no CVSS)
- [CVE-2016-2433](https://cve.now/CVE-2016-2433.md): The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2016-3067](https://cve.now/CVE-2016-3067.md): Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges. (no CVSS)
- [CVE-2016-3109](https://cve.now/CVE-2016-3109.md): The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code. (no CVSS, shopware/shopware)
- [CVE-2016-3702](https://cve.now/CVE-2016-3702.md): Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information. (no CVSS)
- [CVE-2016-5168](https://cve.now/CVE-2016-5168.md): Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive informatio (no CVSS)
- [CVE-2016-5399](https://cve.now/CVE-2016-5399.md): The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a deni (no CVSS)
- [CVE-2016-9954](https://cve.now/CVE-2016-9954.md): The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a (no CVSS)
- [CVE-2017-8050](https://cve.now/CVE-2017-8050.md): Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin passwo (no CVSS)
- [CVE-2017-8051](https://cve.now/CVE-2017-8051.md): Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. (no CVSS)
- [CVE-2017-7994](https://cve.now/CVE-2017-7994.md): The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL p (no CVSS)
- [CVE-2016-0720](https://cve.now/CVE-2016-0720.md): Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149. (no CVSS)
- [CVE-2016-0721](https://cve.now/CVE-2016-0721.md): Session fixation vulnerability in pcsd in pcs before 0.9.157. (no CVSS)
- [CVE-2016-10091](https://cve.now/CVE-2016-10091.md): Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to t (no CVSS)
- [CVE-2016-1555](https://cve.now/CVE-2016-1555.md): (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 (CVSS 9.8, KEV)
- [CVE-2016-1556](https://cve.now/CVE-2016-1556.md): Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND930 before 2.0.11 allo (no CVSS)
- [CVE-2016-1557](https://cve.now/CVE-2016-1557.md): Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP. (no CVSS)
- [CVE-2016-1558](https://cve.now/CVE-2016-1558.md): Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver. (no CVSS)
- [CVE-2016-1559](https://cve.now/CVE-2016-1559.md): D-Link DAP-1353 H/W vers. (no CVSS)
- [CVE-2016-6519](https://cve.now/CVE-2016-6519.md): Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inje (no CVSS, manila-ui)
- [CVE-2016-0833](https://cve.now/CVE-2016-0833.md): Android allows users to cause a denial of service. (no CVSS)
- [CVE-2016-1148](https://cve.now/CVE-2016-1148.md): Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates. (no CVSS)
- [CVE-2016-1184](https://cve.now/CVE-2016-1184.md): Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates. (no CVSS)
- [CVE-2016-1194](https://cve.now/CVE-2016-1194.md): Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service. (no CVSS)
- [CVE-2016-4829](https://cve.now/CVE-2016-4829.md): DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates. (no CVSS)
- [CVE-2016-4830](https://cve.now/CVE-2016-4830.md): Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates. (no CVSS)
- [CVE-2016-4832](https://cve.now/CVE-2016-4832.md): WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates. (no CVSS)
- [CVE-2016-4840](https://cve.now/CVE-2016-4840.md): Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates. (no CVSS)
- [CVE-2016-4841](https://cve.now/CVE-2016-4841.md): Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers. (no CVSS)
- [CVE-2016-4846](https://cve.now/CVE-2016-4846.md): Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2. (no CVSS)
- [CVE-2017-7992](https://cve.now/CVE-2017-7992.md): Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentica (no CVSS)
- [CVE-2016-4075](https://cve.now/CVE-2016-4075.md): Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank (no CVSS)
- [CVE-2017-7220](https://cve.now/CVE-2017-7220.md): OpenText Documentum Content Server allows superuser access via sys\_obj\_save or save of a crafted object, followed by an unauthorized "UPDATE (no CVSS)
- [CVE-2017-7409](https://cve.now/CVE-2017-7409.md): Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 (no CVSS)
- [CVE-2017-7951](https://cve.now/CVE-2017-7951.md): WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context. (no CVSS)
- [CVE-2017-7990](https://cve.now/CVE-2017-7990.md): The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.