# CVEs published 2016-01-12 24 CVEs were published on January 12, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2015-7393](https://cve.now/CVE-2015-7393.md): dcoep in BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AAM 11.4.0 through (no CVSS) - [CVE-2015-7759](https://cve.now/CVE-2015-7759.md): BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configur (no CVSS) - [CVE-2015-8396](https://cve.now/CVE-2015-8396.md): Integer overflow in the ImageRegionReader::ReadIntoBuffer function in MediaStorageAndFileFormat/gdcmImageRegionReader.cxx in Grassroots DICO (no CVSS) - [CVE-2015-8397](https://cve.now/CVE-2015-8397.md): The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows r (no CVSS) - [CVE-2015-8611](https://cve.now/CVE-2015-8611.md): BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platform (no CVSS) - [CVE-2015-8672](https://cve.now/CVE-2015-8672.md): The presentation transmission permission management mechanism in Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints w (no CVSS) - [CVE-2015-8673](https://cve.now/CVE-2015-8673.md): Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 do not require entry of the (no CVSS) - [CVE-2015-8769](https://cve.now/CVE-2015-8769.md): SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors. (no CVSS) - [CVE-2016-1231](https://cve.now/CVE-2016-1231.md): Directory traversal vulnerability in the HTTP file-serving module (mod\_http\_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to (no CVSS) - [CVE-2016-1232](https://cve.now/CVE-2016-1232.md): The mod\_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback (no CVSS) - [CVE-2016-1715](https://cve.now/CVE-2016-1715.md): The swin.sys kernel driver in McAfee Application Control (MAC) 6.1.0 before build 706, 6.1.1 before build 404, 6.1.2 before build 449, 6.1.3 (no CVSS) - [CVE-2015-1779](https://cve.now/CVE-2015-1779.md): The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) we (no CVSS) - [CVE-2015-4671](https://cve.now/CVE-2015-4671.md): Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the z (no CVSS) - [CVE-2015-4703](https://cve.now/CVE-2015-4703.md): Absolute path traversal vulnerability in mysqldump\_download.php in the WordPress Rename plugin 1.0 for WordPress allows remote attackers to (no CVSS) - [CVE-2015-5471](https://cve.now/CVE-2015-5471.md): Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers (no CVSS) - [CVE-2015-7242](https://cve.now/CVE-2015-7242.md): Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arb (no CVSS) - [CVE-2015-7548](https://cve.now/CVE-2015-7548.md): OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use\_cow\_images (no CVSS) - [CVE-2015-8088](https://cve.now/CVE-2015-8088.md): Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL1 (no CVSS) - [CVE-2015-8098](https://cve.now/CVE-2015-8098.md): F5 BIG-IP APM 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 allow remote attackers to cause a denial of servi (no CVSS) - [CVE-2015-8306](https://cve.now/CVE-2015-8306.md): Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-C (no CVSS) - [CVE-2015-8337](https://cve.now/CVE-2015-8337.md): The HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA- (no CVSS) - [CVE-2015-8400](https://cve.now/CVE-2015-8400.md): The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebind (no CVSS) - [CVE-2015-8603](https://cve.now/CVE-2015-8603.md): Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS) - [CVE-2015-8659](https://cve.now/CVE-2015-8659.md): The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-01-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.