CVEs published April 26, 2017
11 CVEs were published on April 26, 2017: 0 critical, 0 high.
- Published
- 11
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- 2
- Hyundai Motor America Blue Link
- 2
- IBM BigFix Inventory
- 1
- IBM Maximo Asset Management
- 1
- IBM WebSphere Commerce Enterprise
- 1
Medium, low and unrated 11
- CVE-2017-3161The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2017-3162HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace.Apache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2016-8924IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate aIBM Maximo Asset Management
- CVE-2016-8962IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromIBM BigFix Inventory
- CVE-2017-1170IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session.IBM WebSphere Commerce Enterprise
- CVE-2017-6052A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4.Hyundai Motor America Blue Link
- CVE-2017-6054A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4.Hyundai Motor America Blue Link
- CVE-2017-7720Buffer overflow in PrivateTunnel 2.7 and 2.8 allows local attackers to cause a denial of service (SEH overwrite) or possibly have unspecifie
- CVE-2017-8284The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit
- CVE-2017-7293The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary syste
- CVE-2017-8283dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indente