# CVEs published 2016-01-30

15 CVEs were published on January 30, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-0867](https://cve.now/CVE-2016-0867.md): CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request. (no CVSS)
- [CVE-2016-1136](https://cve.now/CVE-2016-1136.md): Cross-site scripting (XSS) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web s (no CVSS)
- [CVE-2016-1137](https://cve.now/CVE-2016-1137.md): Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and con (no CVSS)
- [CVE-2016-1138](https://cve.now/CVE-2016-1138.md): CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecifie (no CVSS)
- [CVE-2016-1139](https://cve.now/CVE-2016-1139.md): Cross-site request forgery (CSRF) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication (no CVSS)
- [CVE-2016-1140](https://cve.now/CVE-2016-1140.md): KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors. (no CVSS)
- [CVE-2016-1141](https://cve.now/CVE-2016-1141.md): KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors. (no CVSS)
- [CVE-2016-1143](https://cve.now/CVE-2016-1143.md): Cross-site scripting (XSS) vulnerability in main.rb in Vine MV before 2015-11-08 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2016-1144](https://cve.now/CVE-2016-1144.md): Cross-site scripting (XSS) vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier allows r (no CVSS)
- [CVE-2016-1145](https://cve.now/CVE-2016-1145.md): Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X through 3.3 11.31 on Windows and through 3.3 3.3.1-1 on Linux and So (no CVSS)
- [CVE-2016-1985](https://cve.now/CVE-2016-1985.md): HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, re (no CVSS)
- [CVE-2015-7923](https://cve.now/CVE-2015-7923.md): Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-mi (no CVSS)
- [CVE-2016-1303](https://cve.now/CVE-2016-1303.md): The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, ak (no CVSS)
- [CVE-2016-1304](https://cve.now/CVE-2016-1304.md): Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 10.5(2.3009) allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2016-1488](https://cve.now/CVE-2016-1488.md): Cross-site scripting (XSS) vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-01-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.