# CVEs published 2016-09-26

57 CVEs were published on September 26, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-6309](https://cve.now/CVE-2016-6309.md): statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a… (no CVSS)
- [CVE-2016-7052](https://cve.now/CVE-2016-7052.md): crypto/x509/x509\_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application… (no CVSS)
- [CVE-2016-6038](https://cve.now/CVE-2016-6038.md): Directory traversal vulnerability in Eclipse Help in IBM Tivoli Lightweight Infrastructure (aka LWI), as used in AIX 5.3, 6.1, and 7.1… (no CVSS)
- [CVE-2016-6980](https://cve.now/CVE-2016-6980.md): Use-after-free vulnerability in Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code via unspecified vectors, a… (no CVSS)
- [CVE-2016-3639](https://cve.now/CVE-2016-3639.md): SAP HANA DB 1.00.091.00.1418659308 allows remote attackers to obtain sensitive topology information via an unspecified HTTP request, aka… (no CVSS)
- [CVE-2016-4972](https://cve.now/CVE-2016-4972.md): OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1… (no CVSS, murano-dashboard · python-muranoclient +1)
- [CVE-2016-6142](https://cve.now/CVE-2016-6142.md): SAP HANA DB 1.00.73.00.389160 (NewDB100\_REL) allows remote attackers to inject arbitrary audit trail fields into the SYSLOG via vectors… (no CVSS)
- [CVE-2016-6172](https://cve.now/CVE-2016-6172.md): PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion… (no CVSS)
- [CVE-2016-6826](https://cve.now/CVE-2016-6826.md): Huawei AnyMail before 2.6.0301.0060 allows remote attackers to cause a denial of service (application crash) via a crafted compressed… (no CVSS)
- [CVE-2016-6827](https://cve.now/CVE-2016-6827.md): Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated users to obtain… (no CVSS)
- [CVE-2016-6901](https://cve.now/CVE-2016-6901.md): Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with… (no CVSS)
- [CVE-2016-6913](https://cve.now/CVE-2016-6913.md): Cross-site scripting (XSS) vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2016-5746](https://cve.now/CVE-2016-5746.md): libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which… (no CVSS)
- [CVE-2016-6518](https://cve.now/CVE-2016-6518.md): Memory leak in Huawei S9300, S5300, S5700, S6700, S7700, S9700, and S12700 devices allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-7142](https://cve.now/CVE-2016-7142.md): The m\_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL\_EXTERNAL authentication, allows remote attackers… (no CVSS)
- [CVE-2016-7162](https://cve.now/CVE-2016-7162.md): The \_g\_file\_remove\_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary… (no CVSS)
- [CVE-2016-3110](https://cve.now/CVE-2016-3110.md): mod\_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via… (no CVSS, org.jboss.mod\_cluster:mod\_cluster-parent)
- [CVE-2016-4303](https://cve.now/CVE-2016-4303.md): The parse\_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2016-4993](https://cve.now/CVE-2016-4993.md): CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP)… (no CVSS, org.wildfly:wildfly-undertow)
- [CVE-2016-5395](https://cve.now/CVE-2016-5395.md): Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows… (no CVSS, org.apache.ranger:ranger)
- [CVE-2016-5406](https://cve.now/CVE-2016-5406.md): The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain… (no CVSS)
- [CVE-2016-6276](https://cve.now/CVE-2016-6276.md): Citrix Linux Virtual Delivery Agent (aka VDA, formerly Linux Virtual Desktop) before 1.4.0 allows local users to gain root privileges via… (no CVSS)
- [CVE-2016-6840](https://cve.now/CVE-2016-6840.md): Cross-site scripting (XSS) vulnerability in the management interface in Huawei OceanStor ISM before V200R001C04SPC200 allows remote… (no CVSS)
- [CVE-2016-7098](https://cve.now/CVE-2016-7098.md): Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to… (no CVSS)
- [CVE-2016-8279](https://cve.now/CVE-2016-8279.md): The video driver in Huawei Mate S smartphones with software CRR-TL00 before CRR-TL00C01B362, CRR-UL20 before CRR-UL20C00B362, CRR-CL00… (no CVSS)
- [CVE-2016-0248](https://cve.now/CVE-2016-0248.md): IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information… (no CVSS)
- [CVE-2016-0379](https://cve.now/CVE-2016-0379.md): IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a… (no CVSS)
- [CVE-2016-2999](https://cve.now/CVE-2016-2999.md): IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sensitive information… (no CVSS)
- [CVE-2016-3000](https://cve.now/CVE-2016-3000.md): The help service in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to cause a… (no CVSS)
- [CVE-2016-3001](https://cve.now/CVE-2016-3001.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows… (no CVSS)
- [CVE-2016-3003](https://cve.now/CVE-2016-3003.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows… (no CVSS)
- [CVE-2016-3006](https://cve.now/CVE-2016-3006.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows… (no CVSS)
- [CVE-2016-3007](https://cve.now/CVE-2016-3007.md): Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote… (no CVSS)
- [CVE-2016-3040](https://cve.now/CVE-2016-3040.md): IBM WebSphere Application Server (WAS) Liberty, as used in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before… (no CVSS)
- [CVE-2016-5943](https://cve.now/CVE-2016-5943.md): IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to bypass… (no CVSS)
- [CVE-2016-5944](https://cve.now/CVE-2016-5944.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before… (no CVSS)
- [CVE-2016-5945](https://cve.now/CVE-2016-5945.md): IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to upload… (no CVSS)
- [CVE-2016-5946](https://cve.now/CVE-2016-5946.md): Directory traversal vulnerability in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote… (no CVSS)
- [CVE-2016-5947](https://cve.now/CVE-2016-5947.md): IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to conduct… (no CVSS)
- [CVE-2016-5957](https://cve.now/CVE-2016-5957.md): IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote attackers to defeat cryptographic… (no CVSS)
- [CVE-2016-5963](https://cve.now/CVE-2016-5963.md): IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, which allows… (no CVSS)
- [CVE-2016-5970](https://cve.now/CVE-2016-5970.md): Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote… (no CVSS)
- [CVE-2016-5971](https://cve.now/CVE-2016-5971.md): IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read… (no CVSS)
- [CVE-2016-5972](https://cve.now/CVE-2016-5972.md): IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspecified resources… (no CVSS)
- [CVE-2016-5974](https://cve.now/CVE-2016-5974.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before… (no CVSS)
- [CVE-2016-5975](https://cve.now/CVE-2016-5975.md): Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8… (no CVSS)
- [CVE-2016-5976](https://cve.now/CVE-2016-5976.md): The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117… (no CVSS)
- [CVE-2016-5977](https://cve.now/CVE-2016-5977.md): Open redirect vulnerability in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0… (no CVSS)
- [CVE-2016-5978](https://cve.now/CVE-2016-5978.md): Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8… (no CVSS)
- [CVE-2016-5996](https://cve.now/CVE-2016-5996.md): The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117… (no CVSS)
- [CVE-2016-5997](https://cve.now/CVE-2016-5997.md): The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117… (no CVSS)
- [CVE-2016-6153](https://cve.now/CVE-2016-6153.md): os\_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain… (no CVSS)
- [CVE-2016-6304](https://cve.now/CVE-2016-6304.md): Multiple memory leaks in t1\_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a… (no CVSS)
- [CVE-2016-6305](https://cve.now/CVE-2016-6305.md): The ssl3\_read\_bytes function in record/rec\_layer\_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-6306](https://cve.now/CVE-2016-6306.md): The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-6307](https://cve.now/CVE-2016-6307.md): The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might… (no CVSS)
- [CVE-2016-6308](https://cve.now/CVE-2016-6308.md): statem/statem\_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-09-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.