# CVEs published 2016-02-16

13 CVEs were published on February 16, 2016: 1 critical, 1 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2016-2386](https://cve.now/CVE-2016-2386.md): SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v (CVSS 9.8, KEV)
- [CVE-2016-2387](https://cve.now/CVE-2016-2387.md): Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote… (no CVSS)
- [CVE-2016-2388](https://cve.now/CVE-2016-2388.md): The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted (CVSS 5.3, KEV)
- [CVE-2016-2389](https://cve.now/CVE-2016-2389.md): Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0… (no CVSS)
- [CVE-2015-7576](https://cve.now/CVE-2015-7576.md): The http\_basic\_authenticate\_with method in actionpack/lib/action\_controller/metal/http\_authentication.rb in the Basic Authentication… (no CVSS, actionpack)
- [CVE-2015-7577](https://cve.now/CVE-2015-7577.md): activerecord/lib/active\_record/nested\_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x… (no CVSS, activerecord)
- [CVE-2015-7578](https://cve.now/CVE-2015-7578.md): Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote… (no CVSS, rails-html-sanitizer)
- [CVE-2015-7579](https://cve.now/CVE-2015-7579.md): Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to… (no CVSS, rails-html-sanitizer)
- [CVE-2015-7580](https://cve.now/CVE-2015-7580.md): Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails… (no CVSS, rails-html-sanitizer)
- [CVE-2015-7581](https://cve.now/CVE-2015-7581.md): actionpack/lib/action\_dispatch/routing/route\_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows… (no CVSS, actionpack)
- [CVE-2016-0751](https://cve.now/CVE-2016-0751.md): actionpack/lib/action\_dispatch/http/mime\_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x… (no CVSS, actionpack)
- [CVE-2016-0752](https://cve.now/CVE-2016-0752.md): Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an (CVSS 7.5, KEV, actionview · actionpack)
- [CVE-2016-0753](https://cve.now/CVE-2016-0753.md): Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level… (no CVSS, activemodel)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-02-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.