# CVEs published 2016-07-04

12 CVEs were published on July 4, 2016: 0 critical, 1 high. Days are UTC.

- [CVE-2015-0899](https://cve.now/CVE-2015-0899.md): The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions… (no CVSS, org.apache.struts:struts-core · struts:struts)
- [CVE-2016-1181](https://cve.now/CVE-2016-1181.md): ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote atta (no CVSS, org.apache.struts:struts-core · struts:struts)
- [CVE-2016-1182](https://cve.now/CVE-2016-1182.md): ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attacke (no CVSS, org.apache.struts:struts-core · struts:struts)
- [CVE-2016-3092](https://cve.now/CVE-2016-3092.md): The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x be (CVSS 7.5, commons-fileupload:commons-fileupload)
- [CVE-2016-4430](https://cve.now/CVE-2016-4430.md): Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery… (no CVSS, org.apache.struts.xwork:xwork-core)
- [CVE-2016-4431](https://cve.now/CVE-2016-4431.md): Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by… (no CVSS, org.apache.struts:struts-parent)
- [CVE-2016-4433](https://cve.now/CVE-2016-4433.md): Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via… (no CVSS, org.apache.struts.xwork:xwork-core)
- [CVE-2016-4438](https://cve.now/CVE-2016-4438.md): The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression. (no CVSS, org.apache.struts:struts2-core · org.apache.struts:struts2-…)
- [CVE-2016-4465](https://cve.now/CVE-2016-4465.md): The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of… (no CVSS, org.apache.struts:struts2-core)
- [CVE-2016-0899](https://cve.now/CVE-2016-0899.md): EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential… (no CVSS)
- [CVE-2016-5848](https://cve.now/CVE-2016-5848.md): Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate… (no CVSS)
- [CVE-2016-5849](https://cve.now/CVE-2016-5849.md): Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-07-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.