# CVEs published 2017-04-28

76 CVEs were published on April 28, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-6250](https://cve.now/CVE-2017-6250.md): NVIDIA GeForce Experience contains a vulnerability in NVIDIA Web Helper.exe, where untrusted script execution may lead to violation of appli (no CVSS, Nvidia GeForce Experience)
- [CVE-2016-8584](https://cve.now/CVE-2016-8584.md): Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authe (no CVSS)
- [CVE-2016-8585](https://cve.now/CVE-2016-8585.md): admin\_sys\_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary c (no CVSS)
- [CVE-2016-8586](https://cve.now/CVE-2016-8586.md): detected\_potential\_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute a (no CVSS)
- [CVE-2016-8587](https://cve.now/CVE-2016-8587.md): dlp\_policy\_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2016-8588](https://cve.now/CVE-2016-8588.md): The hotfix\_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2016-8589](https://cve.now/CVE-2016-8589.md): log\_query\_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary co (no CVSS)
- [CVE-2016-8590](https://cve.now/CVE-2016-8590.md): log\_query\_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary co (no CVSS)
- [CVE-2016-8591](https://cve.now/CVE-2016-8591.md): log\_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code a (no CVSS)
- [CVE-2016-8592](https://cve.now/CVE-2016-8592.md): log\_query\_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary (no CVSS)
- [CVE-2016-8593](https://cve.now/CVE-2016-8593.md): Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated (no CVSS)
- [CVE-2017-1141](https://cve.now/CVE-2017-1141.md): IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. (no CVSS, IBM Insights Foundation for Energy)
- [CVE-2017-1194](https://cve.now/CVE-2017-1194.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute (no CVSS, IBM WebSphere Application Server)
- [CVE-2016-7815](https://cve.now/CVE-2016-7815.md): Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the (no CVSS, Cybozu Remote Service Manager)
- [CVE-2016-7839](https://cve.now/CVE-2016-7839.md): Cross-site scripting vulnerability in Olive Blog allows remote attackers to inject arbitrary web script or HTML via the search parameter. (no CVSS, Olive Design Olive Blog)
- [CVE-2016-7840](https://cve.now/CVE-2016-7840.md): Cross-site scripting vulnerability in WEB SCHEDULE allows remote attackers to inject arbitrary web script or HTML via the month parameter. (no CVSS, Olive Design WEB SCHEDULE)
- [CVE-2016-7841](https://cve.now/CVE-2016-7841.md): Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter. (no CVSS, Olive Design Olive Diary DX)
- [CVE-2016-7842](https://cve.now/CVE-2016-7842.md): Directory traversal vulnerability in AttacheCase 2.8.2.8 and earlier and 3.2.0.4 and earlier allows remote attackers to read arbitrary files (no CVSS, HiBARA Software AttacheCase)
- [CVE-2016-7843](https://cve.now/CVE-2016-7843.md): Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 an (no CVSS, MaruUo Factory AttacheCase for Java · MaruUo Factory Att… +1)
- [CVE-2017-2090](https://cve.now/CVE-2017-2090.md): Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unsp (no CVSS, Cybozu Garoon)
- [CVE-2017-2091](https://cve.now/CVE-2017-2091.md): Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the stat (no CVSS, Cybozu Garoon)
- [CVE-2017-2092](https://cve.now/CVE-2017-2092.md): Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbitrary web script or H (no CVSS, Cybozu Garoon)
- [CVE-2017-2093](https://cve.now/CVE-2017-2093.md): Cybozu Garoon 3.0.0 to 4.2.3 allow remote attackers to obtain tokens used for CSRF protection via unspecified vectors. (no CVSS, Cybozu Garoon)
- [CVE-2017-2094](https://cve.now/CVE-2017-2094.md): Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function t (no CVSS, Cybozu Garoon)
- [CVE-2017-2095](https://cve.now/CVE-2017-2095.md): Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in the mail function leading to an alteratio (no CVSS, Cybozu Garoon)
- [CVE-2017-2096](https://cve.now/CVE-2017-2096.md): smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, Ruby Programming Shounendan smalruby-editor · smalruby-e… +1)
- [CVE-2017-2097](https://cve.now/CVE-2017-2097.md): Cross-site request forgery (CSRF) vulnerability in Knowledge versions prior to v1.7.0 allows remote attackers to hijack the authentication o (no CVSS, support-project.org Knowledge)
- [CVE-2017-2098](https://cve.now/CVE-2017-2098.md): Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unsp (no CVSS, CubeCart Limited CubeCart)
- [CVE-2017-2099](https://cve.now/CVE-2017-2099.md): Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote code execution via unspecified vectors. (no CVSS, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Hands-…)
- [CVE-2017-2100](https://cve.now/CVE-2017-2100.md): Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.1 and earlier allows remote attackers to conduct DNS rebinding attac (no CVSS, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Hands-…)
- [CVE-2017-2101](https://cve.now/CVE-2017-2101.md): Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to pe (no CVSS, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Hands-…)
- [CVE-2017-2102](https://cve.now/CVE-2017-2102.md): Cross-site request forgery (CSRF) vulnerability in Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier all (no CVSS, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Hands-…)
- [CVE-2017-2103](https://cve.now/CVE-2017-2103.md): The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacker (no CVSS, K-Opticom LaLa Call App for Android)
- [CVE-2017-2104](https://cve.now/CVE-2017-2104.md): The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle (no CVSS, K-Opticom Business LaLa Call App for Android)
- [CVE-2017-2105](https://cve.now/CVE-2017-2105.md): The TVer App for Android 3.2.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to (no CVSS, PRESENTCAST TVer App for Android)
- [CVE-2017-2106](https://cve.now/CVE-2017-2106.md): Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HT (no CVSS, Webmin)
- [CVE-2017-2107](https://cve.now/CVE-2017-2107.md): Untrusted search path vulnerability in Self-extracting archive files created by 7-ZIP32.DLL 9.22.00.01 and earlier allows remote attackers t (no CVSS, Akky Self-extracting archive files created by 7-ZIP32.DLL)
- [CVE-2017-2108](https://cve.now/CVE-2017-2108.md): Untrusted search path vulnerability in PrimeDrive Desktop Application 1.4.3 and earlier allows remote attackers to gain privileges via a Tro (no CVSS, SoftBank PrimeDrive Desktop Application)
- [CVE-2017-2109](https://cve.now/CVE-2017-2109.md): Cybozu KUNAI for Android 3.0.4 to 3.0.5.1 allow remote attackers to obtain log information through a malicious Android application. (no CVSS, Cybozu KUNAI for Android)
- [CVE-2017-2110](https://cve.now/CVE-2017-2110.md): The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows (no CVSS, NISSAN SECURITIES CO. Access CX App for Android · NISSAN SE…)
- [CVE-2017-2111](https://cve.now/CVE-2017-2111.md): HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware versi (no CVSS, I-O DATA DEVICE TS-WPTCAM · I-O DATA DEVICE TS-WPTCAM2 +4)
- [CVE-2017-2112](https://cve.now/CVE-2017-2112.md): TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware v (no CVSS, I-O DATA DEVICE TS-WPTCAM · I-O DATA DEVICE TS-WPTCAM2 +4)
- [CVE-2017-2113](https://cve.now/CVE-2017-2113.md): Buffer overflow in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, (no CVSS, I-O DATA DEVICE TS-WPTCAM · I-O DATA DEVICE TS-WPTCAM2 +4)
- [CVE-2017-2114](https://cve.now/CVE-2017-2114.md): Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to inject arbitrary web script or (no CVSS, Cybozu Office)
- [CVE-2017-2115](https://cve.now/CVE-2017-2115.md): Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to obtain "customapp" information via unsp (no CVSS, Cybozu Office)
- [CVE-2017-2116](https://cve.now/CVE-2017-2116.md): Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspec (no CVSS, Cybozu Office)
- [CVE-2017-2117](https://cve.now/CVE-2017-2117.md): Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via (no CVSS, CubeCart Limited CubeCart)
- [CVE-2017-2118](https://cve.now/CVE-2017-2118.md): Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspeci (no CVSS, WBCE Team WBCE CMS)
- [CVE-2017-2119](https://cve.now/CVE-2017-2119.md): Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors. (no CVSS, WBCE Team WBCE CMS)
- [CVE-2017-2120](https://cve.now/CVE-2017-2120.md): SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands v (no CVSS, WBCE Team WBCE CMS)
- [CVE-2017-2123](https://cve.now/CVE-2017-2123.md): Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or (no CVSS, SpiQe Software OneThird CMS)
- [CVE-2017-2124](https://cve.now/CVE-2017-2124.md): Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or (no CVSS, SpiQe Software OneThird CMS)
- [CVE-2017-2125](https://cve.now/CVE-2017-2125.md): Privilege escalation vulnerability in CentreCOM AR260S V2 remote authenticated attackers to gain privileges via the guest account. (no CVSS, Allied Telesis K.K. CentreCOM)
- [CVE-2017-2127](https://cve.now/CVE-2017-2127.md): Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via un (no CVSS, YOP Poll)
- [CVE-2017-2128](https://cve.now/CVE-2017-2128.md): Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data. (no CVSS, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) Securi…)
- [CVE-2017-2130](https://cve.now/CVE-2017-2130.md): Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. (no CVSS, SecureBrain The installer of PhishWall Client Internet Expl…)
- [CVE-2017-2134](https://cve.now/CVE-2017-2134.md): Cross-site scripting vulnerability in ASSETBASE 8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecifi (no CVSS, UCHIDA YOKO CO. ASSETBASE)
- [CVE-2017-2135](https://cve.now/CVE-2017-2135.md): Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTM (no CVSS, WP Statistics)
- [CVE-2017-2136](https://cve.now/CVE-2017-2136.md): Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTM (no CVSS, WP Statistics)
- [CVE-2017-2137](https://cve.now/CVE-2017-2137.md): ProSAFE Plus Configuration Utility prior to 2.3.29 allows remote attackers to bypass access restriction and change configurations of the swi (no CVSS)
- [CVE-2017-2139](https://cve.now/CVE-2017-2139.md): CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 a (no CVSS, Frogman Office CS-Cart Japanese Edition · Frogman Office CS…)
- [CVE-2017-2140](https://cve.now/CVE-2017-2140.md): Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted dir (no CVSS, Gaku Tablacus Explorer)
- [CVE-2017-2141](https://cve.now/CVE-2017-2141.md): WN-G300R3 firmware 1.03 and earlier allows attackers with administrator rights to execute arbitrary OS commands via unspecified vectors. (no CVSS, I-O DATA DEVICE WN-G300R3)
- [CVE-2017-2142](https://cve.now/CVE-2017-2142.md): Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, I-O DATA DEVICE WN-G300R3)
- [CVE-2017-2143](https://cve.now/CVE-2017-2143.md): CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to (no CVSS, Frogman Office CS-Cart Japanese Edition · Frogman Office CS…)
- [CVE-2017-2147](https://cve.now/CVE-2017-2147.md): Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTM (no CVSS, WP Statistics)
- [CVE-2017-2148](https://cve.now/CVE-2017-2148.md): Cross-site scripting vulnerability in WN-AC1167GR firmware version 1.04 and earlier allows remote authenticated attackers to inject arbitrar (no CVSS, I-O DATA DEVICE WN-AC1167GR)
- [CVE-2017-2149](https://cve.now/CVE-2017-2149.md): Untrusted search path vulnerability in installers of the software for SDHC/SDXC Memory Card with embedded NFC functionality Software Update (no CVSS, Toshiba Installer for SDHC/SDXC Memory Card with embedde… +3)
- [CVE-2017-2150](https://cve.now/CVE-2017-2150.md): Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially (no CVSS, wpdevelop Booking Calendar)
- [CVE-2017-2151](https://cve.now/CVE-2017-2151.md): Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTM (no CVSS, wpdevelop Booking Calendar)
- [CVE-2017-2152](https://cve.now/CVE-2017-2152.md): WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, BUFFALO WNC01WH)
- [CVE-2017-2153](https://cve.now/CVE-2017-2153.md): SEIL/x86 Fuji 1.70 to 5.62, SEIL/BPV4 5.00 to 5.62, SEIL/X1 1.30 to 5.62, SEIL/X2 1.30 to 5.62, SEIL/B1 1.00 to 5.62 allows remote attackers (no CVSS, Internet Initiative Japan SEIL/x86 Fuji · Internet Initi… +3)
- [CVE-2017-2154](https://cve.now/CVE-2017-2154.md): Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 \[Standard\], JUST Office 3 \[Eco Pri (no CVSS)
- [CVE-2017-2155](https://cve.now/CVE-2017-2155.md): Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execu (no CVSS, ICON Hoozin Viewer)
- [CVE-2017-2156](https://cve.now/CVE-2017-2156.md): Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary cod (no CVSS, Vivaldi Technologies Vivaldi installer for Windows)
- [CVE-2017-7895](https://cve.now/CVE-2017-7895.md): The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows rem (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.