# CVEs published 2017-04-25

37 CVEs were published on April 25, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-8217](https://cve.now/CVE-2017-8217.md): TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not (no CVSS)
- [CVE-2017-8218](https://cve.now/CVE-2017-8218.md): vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 (no CVSS)
- [CVE-2017-8219](https://cve.now/CVE-2017-8219.md): TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie hea (no CVSS)
- [CVE-2017-8220](https://cve.now/CVE-2017-8220.md): TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP reques (no CVSS)
- [CVE-2017-8221](https://cve.now/CVE-2017-8221.md): Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Androi (no CVSS)
- [CVE-2017-8222](https://cve.now/CVE-2017-8222.md): Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate stored in /system/www/ (no CVSS)
- [CVE-2017-8223](https://cve.now/CVE-2017-8223.md): On Wireless IP Camera (P2P) WIFICAM devices, an attacker can use the RTSP server on port 10554/tcp to watch the streaming without authentica (no CVSS)
- [CVE-2017-8224](https://cve.now/CVE-2017-8224.md): Wireless IP Camera (P2P) WIFICAM devices have a backdoor root account that can be accessed with TELNET. (no CVSS)
- [CVE-2017-8225](https://cve.now/CVE-2017-8225.md): On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. (no CVSS)
- [CVE-2017-3342](https://cve.now/CVE-2017-3342.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3345](https://cve.now/CVE-2017-3345.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3347](https://cve.now/CVE-2017-3347.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3355](https://cve.now/CVE-2017-3355.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3356](https://cve.now/CVE-2017-3356.md): Vulnerability in the Oracle Marketing component of Oracle E-Business Suite (subcomponent: User Interface). (no CVSS, Oracle Marketing)
- [CVE-2017-3434](https://cve.now/CVE-2017-3434.md): Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Audience workbench). (no CVSS, Oracle One-to-One Fulfillment)
- [CVE-2017-8115](https://cve.now/CVE-2017-8115.md): Directory traversal in setup/processors/url\_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow rem (no CVSS)
- [CVE-2017-1149](https://cve.now/CVE-2017-1149.md): IBM UrbanCode Deploy (UCD) 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error wh (no CVSS, IBM UrbanCode Deploy)
- [CVE-2017-1274](https://cve.now/CVE-2017-1274.md): IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute (no CVSS, IBM Domino)
- [CVE-2017-7983](https://cve.now/CVE-2017-7983.md): In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent using the JMail API leaked the used PHPMailer version in the mail headers. (no CVSS)
- [CVE-2017-7984](https://cve.now/CVE-2017-7984.md): In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering leads to XSS in the template manager component. (no CVSS)
- [CVE-2017-7985](https://cve.now/CVE-2017-7985.md): In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various compon (no CVSS)
- [CVE-2017-7986](https://cve.now/CVE-2017-7986.md): In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various co (no CVSS)
- [CVE-2017-7987](https://cve.now/CVE-2017-7987.md): In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate escaping of file and folder names leads to XSS vulnerabilities in the template m (no CVSS)
- [CVE-2017-7988](https://cve.now/CVE-2017-7988.md): In Joomla! 1.6.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of form contents allows overwriting the author of an article. (no CVSS)
- [CVE-2017-7989](https://cve.now/CVE-2017-7989.md): In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they we (no CVSS)
- [CVE-2017-8057](https://cve.now/CVE-2017-8057.md): In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting. (no CVSS)
- [CVE-2017-8109](https://cve.now/CVE-2017-8109.md): The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permiss (no CVSS, salt)
- [CVE-2017-8110](https://cve.now/CVE-2017-8110.md): www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php. (no CVSS)
- [CVE-2016-8030](https://cve.now/CVE-2016-8030.md): A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to (no CVSS, McAfee VirusScan Enterprise)
- [CVE-2017-5625](https://cve.now/CVE-2017-5625.md): In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertex (no CVSS)
- [CVE-2017-7221](https://cve.now/CVE-2017-7221.md): OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to (no CVSS)
- [CVE-2017-7477](https://cve.now/CVE-2017-7477.md): Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a deni (no CVSS, Linux kernel)
- [CVE-2017-5047](https://cve.now/CVE-2017-5047.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a rem (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)
- [CVE-2017-5048](https://cve.now/CVE-2017-5048.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a rem (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)
- [CVE-2017-5049](https://cve.now/CVE-2017-5049.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a rem (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)
- [CVE-2017-5050](https://cve.now/CVE-2017-5050.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a rem (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)
- [CVE-2017-5051](https://cve.now/CVE-2017-5051.md): An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a rem (no CVSS, Google Chrome prior to 57.0.2987.98 for Mac, Windows and Li…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.