# CVEs published 2017-04-27

20 CVEs were published on April 27, 2017: 1 critical, 1 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2017-8305](https://cve.now/CVE-2017-8305.md): The UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. (no CVSS)
- [CVE-2017-8307](https://cve.now/CVE-2017-8307.md): In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined (no CVSS)
- [CVE-2017-8308](https://cve.now/CVE-2017-8308.md): In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trusted from the perspect (no CVSS)
- [CVE-2017-8302](https://cve.now/CVE-2017-8302.md): Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm (no CVSS)
- [CVE-2017-8301](https://cve.now/CVE-2017-8301.md): LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL\_get\_verify\_result is relied upon for a later check of a verification resul (no CVSS)
- [CVE-2017-8298](https://cve.now/CVE-2017-8298.md): cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts \> Add New" action, and during creation of new tags and users. (no CVSS, austintoddj/canvas)
- [CVE-2017-5135](https://cve.now/CVE-2017-5135.md): Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases. (no CVSS)
- [CVE-2017-8296](https://cve.now/CVE-2017-8296.md): kedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. (no CVSS)
- [CVE-2017-8297](https://cve.now/CVE-2017-8297.md): A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole "Simple PHP File Manager" comp (no CVSS)
- [CVE-2017-3008](https://cve.now/CVE-2017-3008.md): Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross- (no CVSS, Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, Cold…)
- [CVE-2017-3066](https://cve.now/CVE-2017-3066.md): Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserializa (CVSS 9.8, KEV, Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, Cold…)
- [CVE-2017-5186](https://cve.now/CVE-2017-5186.md): Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetI (no CVSS, NetIQ/Novell iManager and eDirectory)
- [CVE-2017-8294](https://cve.now/CVE-2017-8294.md): libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application c (no CVSS)
- [CVE-2017-7415](https://cve.now/CVE-2017-7415.md): Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST re (no CVSS)
- [CVE-2017-8289](https://cve.now/CVE-2017-8289.md): Stack-based buffer overflow in the ipv6\_addr\_from\_str function in sys/net/network\_layer/ipv6/addr/ipv6\_addr\_from\_str.c in RIOT prior to 2017 (no CVSS)
- [CVE-2017-8291](https://cve.now/CVE-2017-8291.md): Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (CVSS 7.8, KEV)
- [CVE-2017-6035](https://cve.now/CVE-2017-6035.md): A Stack-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. (no CVSS, Wecon Technologies LEVI Studio HMI Editor)
- [CVE-2017-6037](https://cve.now/CVE-2017-6037.md): A Heap-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor before 1.8.1. (no CVSS, Wecon Technologies LEVI Studio HMI Editor)
- [CVE-2017-8287](https://cve.now/CVE-2017-8287.md): FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1\_builder\_close\_contour funct (no CVSS)
- [CVE-2017-8288](https://cve.now/CVE-2017-8288.md): gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.