# CVEs published 2016-02-16 13 CVEs were published on February 16, 2016: 1 critical, 1 high. 3 are now in CISA KEV. Days are UTC. - [CVE-2016-2386](https://cve.now/CVE-2016-2386.md): SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v (CVSS 9.8, KEV) - [CVE-2016-2387](https://cve.now/CVE-2016-2387.md): Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attacker (no CVSS) - [CVE-2016-2388](https://cve.now/CVE-2016-2388.md): The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted (CVSS 5.3, KEV) - [CVE-2016-2389](https://cve.now/CVE-2016-2389.md): Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 fo (no CVSS) - [CVE-2015-7576](https://cve.now/CVE-2015-7576.md): The http\_basic\_authenticate\_with method in actionpack/lib/action\_controller/metal/http\_authentication.rb in the Basic Authentication impleme (no CVSS, actionpack) - [CVE-2015-7577](https://cve.now/CVE-2015-7577.md): activerecord/lib/active\_record/nested\_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x befor (no CVSS, activerecord) - [CVE-2015-7578](https://cve.now/CVE-2015-7578.md): Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attacker (no CVSS, rails-html-sanitizer) - [CVE-2015-7579](https://cve.now/CVE-2015-7579.md): Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to in (no CVSS, rails-html-sanitizer) - [CVE-2015-7580](https://cve.now/CVE-2015-7580.md): Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x (no CVSS, rails-html-sanitizer) - [CVE-2015-7581](https://cve.now/CVE-2015-7581.md): actionpack/lib/action\_dispatch/routing/route\_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows r (no CVSS, actionpack) - [CVE-2016-0751](https://cve.now/CVE-2016-0751.md): actionpack/lib/action\_dispatch/http/mime\_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x bef (no CVSS, actionpack) - [CVE-2016-0752](https://cve.now/CVE-2016-0752.md): Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an (CVSS 7.5, KEV, actionview ยท actionpack) - [CVE-2016-0753](https://cve.now/CVE-2016-0753.md): Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level w (no CVSS, activemodel) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-02-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.