CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In April 2017

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1151 CVE-2016-8593 22 Exec Code Dir. Trav. 2017-04-28 2017-05-10
6.5
None Remote Low ??? Partial Partial Partial
Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
1152 CVE-2016-8592 264 Exec Code 2017-04-28 2017-05-11
9.0
None Remote Low ??? Complete Complete Complete
log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
1153 CVE-2016-8591 264 Exec Code 2017-04-28 2017-05-11
9.0
None Remote Low ??? Complete Complete Complete
log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
1154 CVE-2016-8590 264 Exec Code 2017-04-28 2017-05-10
9.0
None Remote Low ??? Complete Complete Complete
log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
1155 CVE-2016-8589 264 Exec Code 2017-04-28 2017-05-10
9.0
None Remote Low ??? Complete Complete Complete
log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
1156 CVE-2016-8588 284 Exec Code 2017-04-28 2017-05-10
6.0
None Remote Medium ??? Partial Partial Partial
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
1157 CVE-2016-8587 284 Exec Code 2017-04-28 2017-05-25
6.0
None Remote Medium ??? Partial Partial Partial
dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.
1158 CVE-2016-8586 264 Exec Code 2017-04-28 2017-05-12
9.0
None Remote Low ??? Complete Complete Complete
detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
1159 CVE-2016-8585 264 Exec Code 2017-04-28 2017-05-11
9.0
None Remote Low ??? Complete Complete Complete
admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
1160 CVE-2016-8584 284 Bypass 2017-04-28 2017-05-10
7.5
None Remote Low Not required Partial Partial Partial
Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.
1161 CVE-2016-8275 20 2017-04-02 2017-04-05
3.5
None Remote Medium ??? None None Partial
Huawei AnyOffice V200R006C00 could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb.
1162 CVE-2016-8274 284 Exec Code 2017-04-02 2017-04-05
7.2
None Local Low Not required Complete Complete Complete
Huawei PC client software HiSuite 4.0.5.300_OVE has a dynamic link library (DLL) hijack vulnerability; an attacker can make the system load malicious DLL files to execute arbitrary code.
1163 CVE-2016-8273 20 2017-04-02 2017-04-05
6.9
None Local Medium Not required Complete Complete Complete
Huawei PC client software HiSuite 4.0.5.300_OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise the PC.
1164 CVE-2016-8272 200 +Info 2017-04-02 2017-04-05
2.1
None Local Low Not required Partial None None
Huawei PC client software HiSuite 4.0.5.300_OVE has an information leak vulnerability; an attacker who can log in to the system can copy out the user's proxy password, causing information leaks.
1165 CVE-2016-8271 200 +Info 2017-04-02 2017-05-03
5.0
None Remote Low Not required Partial None None
Huawei eSpace IAD V300R002C01SPC100 and earlier versions have an information leak vulnerability; an attacker can check and download the fault information by accessing a special URL.
1166 CVE-2016-8237 264 Exec Code 2017-04-10 2017-04-17
9.3
None Remote Medium Not required Complete Complete Complete
Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.
1167 CVE-2016-8235 264 Exec Code 2017-04-10 2017-04-17
7.2
None Local Low Not required Complete Complete Complete
Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute code with elevated privileges.
1168 CVE-2016-8030 119 DoS Overflow Mem. Corr. 2017-04-25 2017-05-08
4.3
None Remote Medium Not required None None Partial
A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of Service on the active Internet Explorer tab via a crafted HTML link.
1169 CVE-2016-7958 20 2017-04-12 2017-04-17
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/CMakeLists.txt by registering this dissector.
1170 CVE-2016-7957 20 2017-04-12 2017-04-17
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-btl2cap.c by avoiding use of a seven-byte memcmp for potentially shorter strings.
1171 CVE-2016-7843 22 Dir. Trav. 2017-04-28 2017-05-10
4.3
None Remote Medium Not required None Partial None
Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 and earlier allows remote attackers to read arbitrary files via specially crafted ATC file.
1172 CVE-2016-7842 22 Dir. Trav. 2017-04-28 2017-05-10
4.3
None Remote Medium Not required None Partial None
Directory traversal vulnerability in AttacheCase 2.8.2.8 and earlier and 3.2.0.4 and earlier allows remote attackers to read arbitrary files via specially crafted ATC file.
1173 CVE-2016-7841 79 XSS 2017-04-28 2017-05-05
4.3
None Remote Medium Not required None Partial None
Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter.
1174 CVE-2016-7840 79 XSS 2017-04-28 2017-06-05
4.3
None Remote Medium Not required None Partial None
Cross-site scripting vulnerability in WEB SCHEDULE allows remote attackers to inject arbitrary web script or HTML via the month parameter.
1175 CVE-2016-7839 79 XSS 2017-04-28 2017-05-05
4.3
None Remote Medium Not required None Partial None
Cross-site scripting vulnerability in Olive Blog allows remote attackers to inject arbitrary web script or HTML via the search parameter.
1176 CVE-2016-7834 200 +Info 2017-04-13 2017-04-25
3.3
None Local Network Low Not required Partial None None
SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, SNC-EM520, SNC-EM521, SNC-ZB550, SNC-ZM550, SNC-ZM551, SNC-EP550, SNC-EP580, SNC-ER550, SNC-ER550C, SNC-ER580, SNC-ER585, SNC-ER585H, SNC-ZP550, SNC-ZR550, SNC-EP520, SNC-EP521, SNC-ER520, SNC-ER521, SNC-ER521C network cameras with firmware before Ver.1.86.00 and SONY SNC-CX600, SNC-CX600W, SNC-EB600, SNC-EB600B, SNC-EB602R, SNC-EB630, SNC-EB630B, SNC-EB632R, SNC-EM600, SNC-EM601, SNC-EM602R, SNC-EM602RC, SNC-EM630, SNC-EM631, SNC-EM632R, SNC-EM632RC, SNC-VB600, SNC-VB600B, SNC-VB600B5, SNC-VB630, SNC-VB6305, SNC-VB6307, SNC-VB632D, SNC-VB635, SNC-VM600, SNC-VM600B, SNC-VM600B5, SNC-VM601, SNC-VM601B, SNC-VM602R, SNC-VM630, SNC-VM6305, SNC-VM6307, SNC-VM631, SNC-VM632R, SNC-WR600, SNC-WR602, SNC-WR602C, SNC-WR630, SNC-WR632, SNC-WR632C, SNC-XM631, SNC-XM632, SNC-XM636, SNC-XM637, SNC-VB600L, SNC-VM600L, SNC-XM631L, SNC-WR602CL network cameras with firmware before Ver.2.7.2 are prone to sensitive information disclosure. This may allow an attacker on the same local network segment to login to the device with administrative privileges and perform operations on the device.
1177 CVE-2016-7815 295 2017-04-28 2017-05-10
4.9
None Remote Medium ??? Partial Partial None
Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the network.
1178 CVE-2016-7786 264 Bypass 2017-04-07 2018-04-19
9.0
None Remote Low ??? Complete Complete Complete
Sophos Cyberoam UTM CR25iNG 10.6.3 MR-5 allows remote authenticated users to bypass intended access restrictions via direct object reference, as demonstrated by a request for Licenseinformation.jsp. This is fixed in 10.6.5.
1179 CVE-2016-7585 310 2017-04-02 2017-07-12
2.1
None Local Low Not required Partial None None
An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves mishandling of DMA in the "EFI" component. It allows physically proximate attackers to discover the FileVault 2 encryption password via a crafted Thunderbolt adapter.
1180 CVE-2016-7552 22 Dir. Trav. Bypass 2017-04-12 2017-04-17
10.0
None Remote Low Not required Complete Complete Complete
On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
1181 CVE-2016-7551 399 DoS 2017-04-17 2017-04-25
5.0
None Remote Low Not required None None Partial
chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service (port exhaustion).
1182 CVE-2016-7547 361 Exec Code 2017-04-12 2017-04-17
7.5
None Remote Low Not required Partial Partial Partial
A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.
1183 CVE-2016-7540 19 DoS 2017-04-20 2017-05-08
4.3
None Remote Medium Not required None None Partial
coders/rgf.c in ImageMagick before 6.9.4-10 allows remote attackers to cause a denial of service (assertion failure) by converting an image to rgf format.
1184 CVE-2016-7538 787 DoS 2017-04-20 2020-10-14
4.3
None Remote Medium Not required None None Partial
coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
1185 CVE-2016-7537 125 DoS 2017-04-19 2020-11-16
4.3
None Remote Medium Not required None None Partial
MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted PDB file.
1186 CVE-2016-7536 20 DoS 2017-04-20 2020-11-16
4.3
None Remote Medium Not required None None Partial
magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted profile.
1187 CVE-2016-7535 787 DoS 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PSD file.
1188 CVE-2016-7534 125 DoS 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file.
1189 CVE-2016-7533 125 DoS 2017-04-19 2017-05-09
4.3
None Remote Medium Not required None None Partial
The ReadWPGImage function in coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WPG file.
1190 CVE-2016-7532 125 DoS 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
1191 CVE-2016-7531 787 DoS 2017-04-19 2017-05-09
4.3
None Remote Medium Not required None None Partial
MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PDB file.
1192 CVE-2016-7530 369 DoS 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds write) via a crafted file.
1193 CVE-2016-7529 125 DoS 2017-04-19 2017-05-09
4.3
None Remote Medium Not required None None Partial
coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted XCF file.
1194 CVE-2016-7528 125 DoS 2017-04-19 2020-11-16
4.3
None Remote Medium Not required None None Partial
The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file.
1195 CVE-2016-7527 125 DoS 2017-04-20 2020-11-16
4.3
None Remote Medium Not required None None Partial
coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
1196 CVE-2016-7526 787 DoS 2017-04-20 2020-11-16
4.3
None Remote Medium Not required None None Partial
coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
1197 CVE-2016-7525 125 DoS Overflow 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
1198 CVE-2016-7522 125 DoS 2017-04-19 2017-05-09
4.3
None Remote Medium Not required None None Partial
The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
1199 CVE-2016-7521 125 DoS Overflow 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
1200 CVE-2016-7520 125 DoS Overflow 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted HDR file.
Total number of vulnerabilities : 1574   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 (This Page)25 26 27 28 29 30 31 32
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.