# CVEs published 2016-01-26

12 CVEs were published on January 26, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-7974](https://cve.now/CVE-2015-7974.md): NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might al (no CVSS)
- [CVE-2015-8379](https://cve.now/CVE-2015-8379.md): CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the \_method parameter. (no CVSS, cakephp/cakephp)
- [CVE-2016-0869](https://cve.now/CVE-2016-0869.md): Heap-based buffer overflow in MICROSYS PROMOTIC before 8.3.11 allows remote authenticated users to cause a denial of service via a malformed (no CVSS)
- [CVE-2016-1233](https://cve.now/CVE-2016-1233.md): An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 s (no CVSS)
- [CVE-2016-1489](https://cve.now/CVE-2016-1489.md): Lenovo SHAREit before 3.2.0 for Windows and SHAREit before 3.5.48\_ww for Android transfer files in cleartext, which allows remote attackers (no CVSS)
- [CVE-2016-1490](https://cve.now/CVE-2016-1490.md): The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows allows remote attackers to obtain sensitive file names via a crafted file reques (no CVSS)
- [CVE-2016-1491](https://cve.now/CVE-2016-1491.md): The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows, when configured to receive files, has a hardcoded password of 12345678, which m (no CVSS)
- [CVE-2016-1492](https://cve.now/CVE-2016-1492.md): The Wifi hotspot in Lenovo SHAREit before 3.5.48\_ww for Android, when configured to receive files, does not require a password, which makes (no CVSS)
- [CVE-2016-1567](https://cve.now/CVE-2016-1567.md): chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow r (no CVSS)
- [CVE-2016-1926](https://cve.now/CVE-2016-1926.md): Cross-site scripting (XSS) vulnerability in the charts module in Greenbone Security Assistant (GSA) 6.x before 6.0.8 allows remote attackers (no CVSS)
- [CVE-2015-6337](https://cve.now/CVE-2015-6337.md): Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0.10 allows rem (no CVSS)
- [CVE-2016-1298](https://cve.now/CVE-2016-1298.md): Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Contact Center Express 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow rem (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-01-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.