# CVEs published 2016-02-08

27 CVEs were published on February 8, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9757](https://cve.now/CVE-2014-9757.md): The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers (no CVSS)
- [CVE-2015-3251](https://cve.now/CVE-2015-3251.md): Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of (no CVSS)
- [CVE-2015-3252](https://cve.now/CVE-2015-3252.md): Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers t (no CVSS)
- [CVE-2015-8360](https://cve.now/CVE-2015-8360.md): An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via (no CVSS)
- [CVE-2015-8361](https://cve.now/CVE-2015-8361.md): Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote a (no CVSS)
- [CVE-2016-2048](https://cve.now/CVE-2016-2048.md): Django 1.9.x before 1.9.2, when ModelAdmin.save\_as is set to True, allows remote authenticated users to bypass intended access restrictions (no CVSS, django)
- [CVE-2016-2089](https://cve.now/CVE-2016-2089.md): The jas\_matrix\_clip function in jas\_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and applicati (no CVSS)
- [CVE-2016-2091](https://cve.now/CVE-2016-2091.md): The dwarf\_read\_cie\_fde\_prefix function in dwarf\_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds r (no CVSS)
- [CVE-2016-2214](https://cve.now/CVE-2016-2214.md): Cross-site scripting (XSS) vulnerability in an unspecified portal authentication page in Huawei Agile Controller-Campus with software before (no CVSS)
- [CVE-2016-2268](https://cve.now/CVE-2016-2268.md): Dell SecureWorks app before 2.1 for iOS does not validate SSL certificates, which allows man-in-the-middle attackers to spoof servers and ob (no CVSS)
- [CVE-2015-2012](https://cve.now/CVE-2015-2012.md): The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable pe (no CVSS)
- [CVE-2016-0603](https://cve.now/CVE-2016-0603.md): Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote att (no CVSS)
- [CVE-2016-2200](https://cve.now/CVE-2016-2200.md): Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to cause a denial of service (STOP mode transition) via crafted pack (no CVSS)
- [CVE-2016-2201](https://cve.now/CVE-2016-2201.md): Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to bypass a replay protection mechanism via packets on TCP port 102. (no CVSS)
- [CVE-2016-2230](https://cve.now/CVE-2016-2230.md): OpenELEC and RasPlex devices have a hardcoded password for the root account, which makes it easier for remote attackers to obtain access via (no CVSS)
- [CVE-2013-4312](https://cve.now/CVE-2013-4312.md): The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by send (no CVSS)
- [CVE-2015-7513](https://cve.now/CVE-2015-7513.md): arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS user (no CVSS)
- [CVE-2015-7550](https://cve.now/CVE-2015-7550.md): The keyctl\_read\_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows loca (no CVSS)
- [CVE-2015-7566](https://cve.now/CVE-2015-7566.md): The clie\_5\_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a (no CVSS)
- [CVE-2015-8539](https://cve.now/CVE-2015-8539.md): The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyct (no CVSS)
- [CVE-2015-8575](https://cve.now/CVE-2015-8575.md): The sco\_sock\_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local use (no CVSS)
- [CVE-2015-8709](https://cve.now/CVE-2015-8709.md): kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishi (no CVSS)
- [CVE-2015-8767](https://cve.now/CVE-2015-8767.md): net/sctp/sm\_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket, which allows (no CVSS)
- [CVE-2015-8785](https://cve.now/CVE-2015-8785.md): The fuse\_fill\_write\_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinit (no CVSS)
- [CVE-2015-8787](https://cve.now/CVE-2015-8787.md): The nf\_nat\_redirect\_ipv4 function in net/netfilter/nf\_nat\_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denia (no CVSS)
- [CVE-2016-0723](https://cve.now/CVE-2016-0723.md): Race condition in the tty\_ioctl function in drivers/tty/tty\_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive in (no CVSS)
- [CVE-2016-0728](https://cve.now/CVE-2016-0728.md): The join\_session\_keyring function in security/keys/process\_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-02-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.