# CVEs published 2016-01-15

40 CVEs were published on January 15, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-1909](https://cve.now/CVE-2016-1909.md): Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1. (no CVSS)
- [CVE-2016-1910](https://cve.now/CVE-2016-1910.md): The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Not (no CVSS)
- [CVE-2016-1911](https://cve.now/CVE-2016-1911.md): Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via v (no CVSS)
- [CVE-2016-1912](https://cve.now/CVE-2016-1912.md): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web scrip (no CVSS, dolibarr/dolibarr)
- [CVE-2016-1913](https://cve.now/CVE-2016-1913.md): Multiple cross-site scripting (XSS) vulnerabilities in the Redhen module 7.x-1.x before 7.x-1.11 for Drupal allow remote authenticated users (no CVSS)
- [CVE-2015-8675](https://cve.now/CVE-2015-8675.md): Huawei S5300 Campus Series switches with software before V200R005SPH008 do not mask the password when uploading files, which allows physical (no CVSS)
- [CVE-2015-8685](https://cve.now/CVE-2015-8685.md): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2015-8688](https://cve.now/CVE-2015-8688.md): Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza. (no CVSS)
- [CVE-2015-8749](https://cve.now/CVE-2015-8749.md): The volume\_utils.\_parse\_volume\_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes (no CVSS, nova)
- [CVE-2016-1256](https://cve.now/CVE-2016-1256.md): Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20 (no CVSS)
- [CVE-2016-1257](https://cve.now/CVE-2016-1257.md): The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8, 13.3R1 before 13.3R8, 13.3R7 before 13.3R7-S3, 14.1R1 before 14.1R6, 14.1R3 be (no CVSS)
- [CVE-2016-1258](https://cve.now/CVE-2016-1258.md): Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 befo (no CVSS)
- [CVE-2016-1260](https://cve.now/CVE-2016-1260.md): Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-D25, and 15.2 before 15.2R1 on EX4300 series switches allow remote attackers to (no CVSS)
- [CVE-2016-1262](https://cve.now/CVE-2016-1262.md): Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.1X48 before 12.3X48-D20, and 15.1X49 before 15.1X49-D30 on SRX series de (no CVSS)
- [CVE-2015-3943](https://cve.now/CVE-2015-3943.md): Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project accounts via unspecified (no CVSS)
- [CVE-2015-3946](https://cve.now/CVE-2015-3946.md): Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the authentication of un (no CVSS)
- [CVE-2015-3947](https://cve.now/CVE-2015-3947.md): SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands via unspec (no CVSS)
- [CVE-2015-3948](https://cve.now/CVE-2015-3948.md): Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script (no CVSS)
- [CVE-2015-5007](https://cve.now/CVE-2015-5007.md): Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 8 (no CVSS)
- [CVE-2015-6314](https://cve.now/CVE-2015-6314.md): Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow remote attackers to ch (no CVSS)
- [CVE-2015-6320](https://cve.now/CVE-2015-6320.md): The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a denia (no CVSS)
- [CVE-2015-6323](https://cve.now/CVE-2015-6323.md): The Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 bef (no CVSS)
- [CVE-2015-6336](https://cve.now/CVE-2015-6336.md): Cisco Aironet 1800 devices with software 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it easier (no CVSS)
- [CVE-2015-6423](https://cve.now/CVE-2015-6423.md): The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows remote authenticated use (no CVSS)
- [CVE-2015-6467](https://cve.now/CVE-2015-6467.md): Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin. (no CVSS)
- [CVE-2015-8279](https://cve.now/CVE-2015-8279.md): Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script (no CVSS)
- [CVE-2015-8280](https://cve.now/CVE-2015-8280.md): Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages. (no CVSS)
- [CVE-2015-8281](https://cve.now/CVE-2015-8281.md): Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations. (no CVSS)
- [CVE-2016-0851](https://cve.now/CVE-2016-0851.md): Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors. (no CVSS)
- [CVE-2016-0852](https://cve.now/CVE-2016-0852.md): Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via (no CVSS)
- [CVE-2016-0853](https://cve.now/CVE-2016-0853.md): Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input. (no CVSS)
- [CVE-2016-0854](https://cve.now/CVE-2016-0854.md): Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in (no CVSS)
- [CVE-2016-0855](https://cve.now/CVE-2016-0855.md): Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via un (no CVSS)
- [CVE-2016-0856](https://cve.now/CVE-2016-0856.md): Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vec (no CVSS)
- [CVE-2016-0857](https://cve.now/CVE-2016-0857.md): Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vect (no CVSS)
- [CVE-2016-0858](https://cve.now/CVE-2016-0858.md): Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer over (no CVSS)
- [CVE-2016-0859](https://cve.now/CVE-2016-0859.md): Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2016-0860](https://cve.now/CVE-2016-0860.md): Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a craft (no CVSS)
- [CVE-2016-1897](https://cve.now/CVE-2016-1897.md): FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Str (no CVSS)
- [CVE-2016-1898](https://cve.now/CVE-2016-1898.md): FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live St (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.