Security Vulnerabilities - CVEs Published In April 2017
The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.
CVSS Score
2.4
EPSS Score
0.006
Published
2017-04-03
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.
CVSS Score
9.8
EPSS Score
0.05
Published
2017-04-03
During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs.
CVSS Score
9.8
EPSS Score
0.019
Published
2017-04-03
Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.
CVSS Score
7.5
EPSS Score
0.009
Published
2017-04-03
Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.
CVSS Score
7.5
EPSS Score
0.182
Published
2017-04-03
mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code.
CVSS Score
9.8
EPSS Score
0.038
Published
2017-04-03
Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials.
CVSS Score
9.8
EPSS Score
0.023
Published
2017-04-03
The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow remote attackers to obtain private ssh keys.
CVSS Score
7.5
EPSS Score
0.022
Published
2017-04-03
lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to obtain IP addresses and other unspecified router credentials.
CVSS Score
7.5
EPSS Score
0.017
Published
2017-04-03
OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.
CVSS Score
4.8
EPSS Score
0.011
Published
2017-04-03