# CVEs published 2016-01-08

47 CVEs were published on January 8, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2014-6444](https://cve.now/CVE-2014-6444.md): Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject (no CVSS)
- [CVE-2014-7151](https://cve.now/CVE-2014-7151.md): Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitr (no CVSS)
- [CVE-2015-7512](https://cve.now/CVE-2015-7512.md): Buffer overflow in the pcnet\_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause (no CVSS)
- [CVE-2015-7541](https://cve.now/CVE-2015-7541.md): The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-depen (no CVSS, colorscore)
- [CVE-2015-8376](https://cve.now/CVE-2015-8376.md): Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2015-8766](https://cve.now/CVE-2015-8766.md): Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attac (no CVSS, symphonycms/symphony-2)
- [CVE-2016-1498](https://cve.now/CVE-2016-1498.md): Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1. (no CVSS)
- [CVE-2016-1499](https://cve.now/CVE-2016-1499.md): ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information f (no CVSS)
- [CVE-2016-1500](https://cve.now/CVE-2016-1500.md): ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file\_versions" application is enab (no CVSS)
- [CVE-2016-1501](https://cve.now/CVE-2016-1501.md): ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors (no CVSS)
- [CVE-2016-1565](https://cve.now/CVE-2016-1565.md): Cross-site scripting (XSS) vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with (no CVSS)
- [CVE-2014-8886](https://cve.now/CVE-2014-8886.md): AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attac (no CVSS)
- [CVE-2015-4694](https://cve.now/CVE-2015-4694.md): Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read a (no CVSS)
- [CVE-2015-8557](https://cve.now/CVE-2015-8557.md): The FontManager.\_get\_nix\_font\_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrar (no CVSS, pygments)
- [CVE-2015-8765](https://cve.now/CVE-2015-8765.md): Intel McAfee ePolicy Orchestrator (ePO) 4.6.9 and earlier, 5.0.x, 5.1.x before 5.1.3 Hotfix 1106041, and 5.3.x before 5.3.1 Hotfix 1106041 a (no CVSS)
- [CVE-2015-5254](https://cve.now/CVE-2015-5254.md): Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execu (no CVSS, org.apache.activemq:activemq-client)
- [CVE-2015-5259](https://cve.now/CVE-2015-5259.md): Integer overflow in the read\_string function in libsvn\_ra\_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to e (no CVSS)
- [CVE-2015-6856](https://cve.now/CVE-2015-6856.md): Dell Pre-Boot Authentication Driver (PBADRV.sys) 1.0.1.5 allows local users to write to arbitrary physical memory locations and gain privile (no CVSS)
- [CVE-2015-7328](https://cve.now/CVE-2015-7328.md): Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private ke (no CVSS)
- [CVE-2015-7362](https://cve.now/CVE-2015-7362.md): Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allo (no CVSS)
- [CVE-2015-7519](https://cve.now/CVE-2015-7519.md): agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in (no CVSS, passenger)
- [CVE-2015-7554](https://cve.now/CVE-2015-7554.md): The \_TIFFVGetField function in tif\_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or (no CVSS)
- [CVE-2015-7754](https://cve.now/CVE-2015-7754.md): Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash (no CVSS)
- [CVE-2015-7758](https://cve.now/CVE-2015-7758.md): Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing fi (no CVSS)
- [CVE-2015-8225](https://cve.now/CVE-2015-8225.md): The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL0 (no CVSS)
- [CVE-2015-8226](https://cve.now/CVE-2015-8226.md): The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL0 (no CVSS)
- [CVE-2015-8303](https://cve.now/CVE-2015-8303.md): Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file, wh (no CVSS)
- [CVE-2015-8481](https://cve.now/CVE-2015-8481.md): Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notific (no CVSS)
- [CVE-2015-8547](https://cve.now/CVE-2015-8547.md): The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2015-8597](https://cve.now/CVE-2015-8597.md): Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attacke (no CVSS)
- [CVE-2015-8612](https://cve.now/CVE-2015-8612.md): The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges (no CVSS)
- [CVE-2015-8615](https://cve.now/CVE-2015-8615.md): The hvm\_set\_callback\_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new (no CVSS)
- [CVE-2015-8668](https://cve.now/CVE-2015-8668.md): Heap-based buffer overflow in the PackBitsPreEncode function in tif\_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attack (no CVSS)
- [CVE-2015-8753](https://cve.now/CVE-2015-8753.md): SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related (no CVSS)
- [CVE-2015-8754](https://cve.now/CVE-2015-8754.md): The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom bl (no CVSS)
- [CVE-2015-8755](https://cve.now/CVE-2015-8755.md): Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allo (no CVSS, typo3/cms)
- [CVE-2015-8756](https://cve.now/CVE-2015-8756.md): Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed\_search) component in TYPO3 6.2.x before 6. (no CVSS, typo3/cms)
- [CVE-2015-8757](https://cve.now/CVE-2015-8757.md): Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers (no CVSS)
- [CVE-2015-8758](https://cve.now/CVE-2015-8758.md): Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 all (no CVSS)
- [CVE-2015-8759](https://cve.now/CVE-2015-8759.md): Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authentica (no CVSS, typo3/cms)
- [CVE-2015-8760](https://cve.now/CVE-2015-8760.md): The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vec (no CVSS, typo3/cms)
- [CVE-2015-8761](https://cve.now/CVE-2015-8761.md): The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import (no CVSS)
- [CVE-2015-6433](https://cve.now/CVE-2015-6433.md): SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary (no CVSS)
- [CVE-2015-6434](https://cve.now/CVE-2015-6434.md): Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjac (no CVSS)
- [CVE-2015-6862](https://cve.now/CVE-2015-6862.md): HPE UCMDB Browser before 4.02 allows remote attackers to obtain sensitive information or bypass intended access restrictions via unspecified (no CVSS)
- [CVE-2015-8261](https://cve.now/CVE-2015-8261.md): The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which (no CVSS)
- [CVE-2016-1131](https://cve.now/CVE-2016-1131.md): Buffer overflow in the CL\_vsprintf function in Takumi Yamada DX Library before 3.16 allows remote attackers to execute arbitrary code via a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.