# CVEs published 2016-01-15

40 CVEs were published on January 15, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-1909](https://cve.now/CVE-2016-1909.md): Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS… (no CVSS)
- [CVE-2016-1910](https://cve.now/CVE-2016-1910.md): The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security… (no CVSS)
- [CVE-2016-1911](https://cve.now/CVE-2016-1911.md): Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2016-1912](https://cve.now/CVE-2016-1912.md): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web… (no CVSS, dolibarr/dolibarr)
- [CVE-2016-1913](https://cve.now/CVE-2016-1913.md): Multiple cross-site scripting (XSS) vulnerabilities in the Redhen module 7.x-1.x before 7.x-1.11 for Drupal allow remote authenticated… (no CVSS)
- [CVE-2015-8675](https://cve.now/CVE-2015-8675.md): Huawei S5300 Campus Series switches with software before V200R005SPH008 do not mask the password when uploading files, which allows… (no CVSS)
- [CVE-2015-8685](https://cve.now/CVE-2015-8685.md): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2015-8688](https://cve.now/CVE-2015-8688.md): Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza. (no CVSS)
- [CVE-2015-8749](https://cve.now/CVE-2015-8749.md): The volume\_utils.\_parse\_volume\_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty)… (no CVSS, nova)
- [CVE-2016-1256](https://cve.now/CVE-2016-1256.md): Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before… (no CVSS)
- [CVE-2016-1257](https://cve.now/CVE-2016-1257.md): The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8, 13.3R1 before 13.3R8, 13.3R7 before 13.3R7-S3, 14.1R1 before 14.1R6, 14.1R3… (no CVSS)
- [CVE-2016-1258](https://cve.now/CVE-2016-1258.md): Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3… (no CVSS)
- [CVE-2016-1260](https://cve.now/CVE-2016-1260.md): Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-D25, and 15.2 before 15.2R1 on EX4300 series switches allow remote attackers… (no CVSS)
- [CVE-2016-1262](https://cve.now/CVE-2016-1262.md): Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.1X48 before 12.3X48-D20, and 15.1X49 before 15.1X49-D30 on SRX series… (no CVSS)
- [CVE-2015-3943](https://cve.now/CVE-2015-3943.md): Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via… (no CVSS)
- [CVE-2015-3946](https://cve.now/CVE-2015-3946.md): Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2015-3947](https://cve.now/CVE-2015-3947.md): SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2015-3948](https://cve.now/CVE-2015-3948.md): Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web… (no CVSS)
- [CVE-2015-5007](https://cve.now/CVE-2015-5007.md): Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack… (no CVSS)
- [CVE-2015-6314](https://cve.now/CVE-2015-6314.md): Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow remote attackers to… (no CVSS)
- [CVE-2015-6320](https://cve.now/CVE-2015-6320.md): The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a… (no CVSS)
- [CVE-2015-6323](https://cve.now/CVE-2015-6323.md): The Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4… (no CVSS)
- [CVE-2015-6336](https://cve.now/CVE-2015-6336.md): Cisco Aironet 1800 devices with software 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it… (no CVSS)
- [CVE-2015-6423](https://cve.now/CVE-2015-6423.md): The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows remote authenticated… (no CVSS)
- [CVE-2015-6467](https://cve.now/CVE-2015-6467.md): Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin. (no CVSS)
- [CVE-2015-8279](https://cve.now/CVE-2015-8279.md): Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP… (no CVSS)
- [CVE-2015-8280](https://cve.now/CVE-2015-8280.md): Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages. (no CVSS)
- [CVE-2015-8281](https://cve.now/CVE-2015-8281.md): Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations. (no CVSS)
- [CVE-2016-0851](https://cve.now/CVE-2016-0851.md): Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors. (no CVSS)
- [CVE-2016-0852](https://cve.now/CVE-2016-0852.md): Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access… (no CVSS)
- [CVE-2016-0853](https://cve.now/CVE-2016-0853.md): Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input. (no CVSS)
- [CVE-2016-0854](https://cve.now/CVE-2016-0854.md): Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer… (no CVSS)
- [CVE-2016-0855](https://cve.now/CVE-2016-0855.md): Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via… (no CVSS)
- [CVE-2016-0856](https://cve.now/CVE-2016-0856.md): Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified… (no CVSS)
- [CVE-2016-0857](https://cve.now/CVE-2016-0857.md): Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified… (no CVSS)
- [CVE-2016-0858](https://cve.now/CVE-2016-0858.md): Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer… (no CVSS)
- [CVE-2016-0859](https://cve.now/CVE-2016-0859.md): Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a… (no CVSS)
- [CVE-2016-0860](https://cve.now/CVE-2016-0860.md): Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a… (no CVSS)
- [CVE-2016-1897](https://cve.now/CVE-2016-1897.md): FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live… (no CVSS)
- [CVE-2016-1898](https://cve.now/CVE-2016-1898.md): FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.