# CVEs published 2016-01-08

47 CVEs were published on January 8, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2014-6444](https://cve.now/CVE-2014-6444.md): Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to… (no CVSS)
- [CVE-2014-7151](https://cve.now/CVE-2014-7151.md): Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject… (no CVSS)
- [CVE-2015-7512](https://cve.now/CVE-2015-7512.md): Buffer overflow in the pcnet\_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to… (no CVSS)
- [CVE-2015-7541](https://cve.now/CVE-2015-7541.md): The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows… (no CVSS, colorscore)
- [CVE-2015-8376](https://cve.now/CVE-2015-8376.md): Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary web script or HTML… (no CVSS)
- [CVE-2015-8766](https://cve.now/CVE-2015-8766.md): Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote… (no CVSS, symphonycms/symphony-2)
- [CVE-2016-1498](https://cve.now/CVE-2016-1498.md): Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10… (no CVSS)
- [CVE-2016-1499](https://cve.now/CVE-2016-1499.md): ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information… (no CVSS)
- [CVE-2016-1500](https://cve.now/CVE-2016-1500.md): ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file\_versions" application is… (no CVSS)
- [CVE-2016-1501](https://cve.now/CVE-2016-1501.md): ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified… (no CVSS)
- [CVE-2016-1565](https://cve.now/CVE-2016-1565.md): Cross-site scripting (XSS) vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users… (no CVSS)
- [CVE-2014-8886](https://cve.now/CVE-2014-8886.md): AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote… (no CVSS)
- [CVE-2015-4694](https://cve.now/CVE-2015-4694.md): Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read… (no CVSS)
- [CVE-2015-8557](https://cve.now/CVE-2015-8557.md): The FontManager.\_get\_nix\_font\_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute… (no CVSS, pygments)
- [CVE-2015-8765](https://cve.now/CVE-2015-8765.md): Intel McAfee ePolicy Orchestrator (ePO) 4.6.9 and earlier, 5.0.x, 5.1.x before 5.1.3 Hotfix 1106041, and 5.3.x before 5.3.1 Hotfix 1106041… (no CVSS)
- [CVE-2015-5254](https://cve.now/CVE-2015-5254.md): Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to… (no CVSS, org.apache.activemq:activemq-client)
- [CVE-2015-5259](https://cve.now/CVE-2015-5259.md): Integer overflow in the read\_string function in libsvn\_ra\_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to… (no CVSS)
- [CVE-2015-6856](https://cve.now/CVE-2015-6856.md): Dell Pre-Boot Authentication Driver (PBADRV.sys) 1.0.1.5 allows local users to write to arbitrary physical memory locations and gain… (no CVSS)
- [CVE-2015-7328](https://cve.now/CVE-2015-7328.md): Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private… (no CVSS)
- [CVE-2015-7362](https://cve.now/CVE-2015-7362.md): Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable… (no CVSS)
- [CVE-2015-7519](https://cve.now/CVE-2015-7519.md): agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or… (no CVSS, passenger)
- [CVE-2015-7554](https://cve.now/CVE-2015-7554.md): The \_TIFFVGetField function in tif\_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash)… (no CVSS)
- [CVE-2015-7754](https://cve.now/CVE-2015-7754.md): Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system… (no CVSS)
- [CVE-2015-7758](https://cve.now/CVE-2015-7758.md): Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing… (no CVSS)
- [CVE-2015-8225](https://cve.now/CVE-2015-8225.md): The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and… (no CVSS)
- [CVE-2015-8226](https://cve.now/CVE-2015-8226.md): The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and… (no CVSS)
- [CVE-2015-8303](https://cve.now/CVE-2015-8303.md): Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file… (no CVSS)
- [CVE-2015-8481](https://cve.now/CVE-2015-8481.md): Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail… (no CVSS)
- [CVE-2015-8547](https://cve.now/CVE-2015-8547.md): The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2015-8597](https://cve.now/CVE-2015-8597.md): Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote… (no CVSS)
- [CVE-2015-8612](https://cve.now/CVE-2015-8612.md): The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain… (no CVSS)
- [CVE-2015-8615](https://cve.now/CVE-2015-8615.md): The hvm\_set\_callback\_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the… (no CVSS)
- [CVE-2015-8668](https://cve.now/CVE-2015-8668.md): Heap-based buffer overflow in the PackBitsPreEncode function in tif\_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote… (no CVSS)
- [CVE-2015-8753](https://cve.now/CVE-2015-8753.md): SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request… (no CVSS)
- [CVE-2015-8754](https://cve.now/CVE-2015-8754.md): The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom… (no CVSS)
- [CVE-2015-8755](https://cve.now/CVE-2015-8755.md): Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1… (no CVSS, typo3/cms)
- [CVE-2015-8756](https://cve.now/CVE-2015-8756.md): Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed\_search) component in TYPO3 6.2.x before… (no CVSS, typo3/cms)
- [CVE-2015-8757](https://cve.now/CVE-2015-8757.md): Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote… (no CVSS)
- [CVE-2015-8758](https://cve.now/CVE-2015-8758.md): Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1… (no CVSS)
- [CVE-2015-8759](https://cve.now/CVE-2015-8759.md): Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote… (no CVSS, typo3/cms)
- [CVE-2015-8760](https://cve.now/CVE-2015-8760.md): The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified… (no CVSS, typo3/cms)
- [CVE-2015-8761](https://cve.now/CVE-2015-8761.md): The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the… (no CVSS)
- [CVE-2015-6433](https://cve.now/CVE-2015-6433.md): SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute… (no CVSS)
- [CVE-2015-6434](https://cve.now/CVE-2015-6434.md): Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct… (no CVSS)
- [CVE-2015-6862](https://cve.now/CVE-2015-6862.md): HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via… (no CVSS)
- [CVE-2015-8261](https://cve.now/CVE-2015-8261.md): The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects… (no CVSS)
- [CVE-2016-1131](https://cve.now/CVE-2016-1131.md): Buffer overflow in the CL\_vsprintf function in Takumi Yamada DX Library before 3.16 allows remote attackers to execute arbitrary code via… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.