CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In April 2017

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1201 CVE-2016-7519 125 DoS 2017-04-19 2017-05-09
4.3
None Remote Medium Not required None None Partial
The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
1202 CVE-2016-7518 125 DoS 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SUN file.
1203 CVE-2016-7517 125 DoS 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
The EncodeImage function in coders/pict.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PICT file.
1204 CVE-2016-7516 125 DoS 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted VIFF file.
1205 CVE-2016-7515 125 DoS 2017-04-19 2017-05-09
4.3
None Remote Medium Not required None None Partial
The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the number of pixels.
1206 CVE-2016-7514 125 DoS 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
1207 CVE-2016-7513 189 DoS 2017-04-20 2017-05-09
4.3
None Remote Medium Not required None None Partial
Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors.
1208 CVE-2016-7467 20 2017-04-11 2017-07-12
3.5
None Remote Medium ??? None None Partial
The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider (SP) connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via the SP connector.
1209 CVE-2016-7060 200 +Info 2017-04-14 2017-04-25
2.1
None Local Low Not required Partial None None
The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display.
1210 CVE-2016-7051 611 2017-04-14 2019-10-10
5.0
None Remote Low Not required None Partial None
XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
1211 CVE-2016-7032 284 Bypass 2017-04-14 2020-09-30
6.9
None Local Medium Not required Complete Complete Complete
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.
1212 CVE-2016-6917 119 Overflow 2017-04-24 2017-10-19
7.2
None Local Low Not required Complete Complete Complete
Buffer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1 before OTA 1.5.
1213 CVE-2016-6916 190 DoS Overflow 2017-04-24 2017-10-19
7.2
None Local Low Not required Complete Complete Complete
Integer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1 before OTA 1.5 allows local users to cause a denial of service (system crash) via unspecified vectors, which triggers a buffer overflow.
1214 CVE-2016-6915 119 Overflow 2017-04-24 2017-10-19
7.2
None Local Low Not required Complete Complete Complete
Stack-based buffer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1 before OTA 1.5.
1215 CVE-2016-6903 264 Exec Code 2017-04-24 2017-04-27
9.0
None Remote Low ??? Complete Complete Complete
lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
1216 CVE-2016-6902 264 Exec Code 2017-04-24 2017-04-27
9.0
None Remote Low ??? Complete Complete Complete
lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
1217 CVE-2016-6879 320 2017-04-10 2017-04-15
5.0
None Remote Low Not required None Partial None
The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more than one Key_Usage set in the enum value.
1218 CVE-2016-6878 20 2017-04-10 2017-04-15
7.5
None Remote Low Not required Partial Partial Partial
The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified impact via vectors related to undefined behavior, as demonstrated on 32-bit ARM systems compiled by Clang.
1219 CVE-2016-6818 89 DoS Sql +Info 2017-04-13 2018-12-10
10.0
None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive information, modify data, cause a denial of service (data deletion), or launch administrative operations or possibly OS commands via a crafted SQL query. The vendor response is SAP Security Note 2361633.
1220 CVE-2016-6811 264 2017-04-11 2018-05-10
9.0
None Remote Low ??? Complete Complete Complete
In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
1221 CVE-2016-6809 502 Exec Code 2017-04-06 2020-08-19
7.5
None Remote Low Not required Partial Partial Partial
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
1222 CVE-2016-6808 119 Overflow 2017-04-12 2019-04-15
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
1223 CVE-2016-6805 611 2017-04-07 2017-04-13
4.3
None Remote Medium Not required Partial None None
Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
1224 CVE-2016-6727 264 Exec Code 2017-04-17 2017-04-24
10.0
None Remote Low Not required Complete Complete Complete
The Qualcomm GPS subsystem in Android on Android One devices allows remote attackers to execute arbitrary code.
1225 CVE-2016-6726 2017-04-17 2017-04-20
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Qualcomm components in Android on Nexus 6 and Android One devices.
1226 CVE-2016-6605 284 Bypass 2017-04-10 2017-04-14
5.0
None Remote Low Not required Partial None None
Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.
1227 CVE-2016-6534 77 2017-04-10 2017-04-14
6.0
None Remote Medium ??? Partial Partial Partial
Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. Versions before 8.5.12G might be affected in non-default configurations.
1228 CVE-2016-6519 79 XSS 2017-04-21 2021-08-04
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.
1229 CVE-2016-6489 203 2017-04-14 2020-11-16
5.0
None Remote Low Not required Partial None None
The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.
1230 CVE-2016-6368 399 DoS Bypass 2017-04-20 2017-05-06
5.0
None Remote Low Not required None None Partial
A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper input validation of the fields in the PGM protocol packet. An attacker could exploit this vulnerability by sending a crafted PGM packet to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or traffic is dropped. This vulnerability affects Cisco Firepower System Software that has one or more file action policies configured and is running on any of the following Cisco products: Adaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services; Adaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls; Advanced Malware Protection (AMP) for Networks, 7000 Series Appliances; Advanced Malware Protection (AMP) for Networks, 8000 Series Appliances; Firepower 4100 Series Security Appliances; FirePOWER 7000 Series Appliances; FirePOWER 8000 Series Appliances; Firepower 9300 Series Security Appliances; FirePOWER Threat Defense for Integrated Services Routers (ISRs); Industrial Security Appliance 3000; Sourcefire 3D System Appliances; Virtual Next-Generation Intrusion Prevention System (NGIPSv) for VMware. Fixed versions: 5.4.0.10 5.4.1.9 6.0.1.3 6.1.0 6.2.0. Cisco Bug IDs: CSCuz00876.
1231 CVE-2016-6348 79 XSS 2017-04-12 2017-04-19
4.3
None Remote Medium Not required None Partial None
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.
1232 CVE-2016-6347 79 XSS 2017-04-20 2017-04-25
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
1233 CVE-2016-6341 200 +Info 2017-04-20 2017-04-25
2.1
None Local Low Not required Partial None None
oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files.
1234 CVE-2016-6338 284 Bypass 2017-04-20 2017-12-13
4.6
None Local Low Not required Partial Partial Partial
ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries.
1235 CVE-2016-6337 284 Bypass 2017-04-20 2017-04-24
5.0
None Remote Low Not required None Partial None
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
1236 CVE-2016-6336 284 Bypass 2017-04-20 2017-04-24
4.0
None Remote Low ??? None Partial None
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.
1237 CVE-2016-6335 200 +Info 2017-04-20 2017-04-24
5.0
None Remote Low Not required Partial None None
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php.
1238 CVE-2016-6334 79 XSS 2017-04-20 2017-04-29
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.
1239 CVE-2016-6333 79 XSS 2017-04-20 2017-04-29
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.
1240 CVE-2016-6332 200 +Info 2017-04-20 2017-04-24
5.0
None Remote Low Not required Partial None None
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.
1241 CVE-2016-6331 284 Bypass 2017-04-20 2017-04-24
5.0
None Remote Low Not required Partial None None
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
1242 CVE-2016-6299 264 +Priv Bypass 2017-04-14 2017-04-25
9.3
None Remote Medium Not required Complete Complete Complete
The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file.
1243 CVE-2016-6177 190 Overflow 2017-04-02 2017-04-06
4.0
None Remote Low ??? None None Partial
The Huawei OceanStor 5800 V300R003C00 has an integer overflow vulnerability. An authenticated attacker may send massive abnormal Network File System (NFS) packets, causing an anomaly in specific disk arrays.
1244 CVE-2016-6143 284 Exec Code 2017-04-13 2017-04-20
7.5
None Remote Low Not required Partial Partial Partial
SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note 2170806.
1245 CVE-2016-6100 352 CSRF 2017-04-05 2017-04-12
6.8
None Remote Medium Not required Partial Partial Partial
IBM Disposal and Governance Management for IT and IBM Global Retention Policy and Schedule Management, components of IBM Atlas Policy Suite 6.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 2000771.
1246 CVE-2016-5870 476 DoS 2017-04-04 2020-07-31
4.6
None Local Low Not required Partial Partial Partial
The msm_ipc_router_close function in net/ipc_router/ipc_router_socket.c in the ipc_router component for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact by triggering failure of an accept system call for an AF_MSM_IPC socket.
1247 CVE-2016-5856 264 +Priv 2017-04-12 2017-04-19
7.6
None Remote High Not required Complete Complete Complete
Drivers/soc/qcom/spcom.c in the Qualcomm SPCom driver in the Android kernel 2017-03-05 allows local users to gain privileges, a different vulnerability than CVE-2016-5857.
1248 CVE-2016-5762 190 Exec Code Overflow 2017-04-20 2019-05-30
7.5
None Remote Low Not required Partial Partial Partial
Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code via a long (1) username or (2) password, which triggers a heap-based buffer overflow.
1249 CVE-2016-5761 79 XSS 2017-04-20 2019-05-30
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allows remote attackers to inject arbitrary web script or HTML via a crafted email.
1250 CVE-2016-5760 79 XSS 2017-04-20 2019-05-30
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attackers to inject arbitrary web script or HTML via the (1) token parameter to gwadmin-console/install/login.jsp or (2) PATH_INFO to gwadmin-console/index.jsp.
Total number of vulnerabilities : 1574   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 (This Page)26 27 28 29 30 31 32
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.