# CVEs published 2016-04-07

36 CVEs were published on April 7, 2016: 0 critical, 2 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2016-0788](https://cve.now/CVE-2016-0788.md): The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP liste (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-0789](https://cve.now/CVE-2016-0789.md): CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inje (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-0790](https://cve.now/CVE-2016-0790.md): Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote atta (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-0791](https://cve.now/CVE-2016-0791.md): Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote att (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-0792](https://cve.now/CVE-2016-0792.md): Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-1531](https://cve.now/CVE-2016-1531.md): Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl\_startup argument. (no CVSS)
- [CVE-2016-2097](https://cve.now/CVE-2016-2097.md): Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read ar (no CVSS, actionview · actionpack)
- [CVE-2016-2098](https://cve.now/CVE-2016-2098.md): Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Rub (no CVSS, actionpack)
- [CVE-2016-2563](https://cve.now/CVE-2016-2563.md): Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cau (no CVSS)
- [CVE-2016-2789](https://cve.now/CVE-2016-2789.md): Cross-site scripting (XSS) vulnerability in the Web User Interface in Citrix XenMobile Server 10.0, 10.1 before Rolling Patch 4, and 10.3 be (no CVSS)
- [CVE-2016-2851](https://cve.now/CVE-2016-2851.md): Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corrupti (no CVSS)
- [CVE-2016-3976](https://cve.now/CVE-2016-3976.md): Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\\ (dot do (CVSS 7.5, KEV)
- [CVE-2015-2774](https://cve.now/CVE-2015-2774.md): Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-midd (no CVSS)
- [CVE-2016-0729](https://cve.now/CVE-2016-0729.md): Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xe (no CVSS)
- [CVE-2016-2086](https://cve.now/CVE-2016-2086.md): Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request (no CVSS)
- [CVE-2016-2216](https://cve.now/CVE-2016-2216.md): The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x befo (no CVSS)
- [CVE-2016-2511](https://cve.now/CVE-2016-2511.md): Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2015-8307](https://cve.now/CVE-2015-8307.md): The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before (no CVSS)
- [CVE-2015-8318](https://cve.now/CVE-2015-8318.md): Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL (no CVSS)
- [CVE-2015-8319](https://cve.now/CVE-2015-8319.md): Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL (no CVSS)
- [CVE-2015-8679](https://cve.now/CVE-2015-8679.md): The Maxim\_smartpa\_dev driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL (no CVSS)
- [CVE-2015-8680](https://cve.now/CVE-2015-8680.md): The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before (no CVSS)
- [CVE-2015-8681](https://cve.now/CVE-2015-8681.md): The ovisp driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GR (no CVSS)
- [CVE-2016-2510](https://cve.now/CVE-2016-2510.md): BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attack (no CVSS, org.apache-extras.beanshell:bsh)
- [CVE-2015-8305](https://cve.now/CVE-2015-8305.md): Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted (no CVSS)
- [CVE-2016-0734](https://cve.now/CVE-2016-0734.md): The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easie (no CVSS, org.apache.activemq:activemq-client)
- [CVE-2016-1714](https://cve.now/CVE-2016-1714.md): The (1) fw\_cfg\_write and (2) fw\_cfg\_read functions in hw/nvram/fw\_cfg.c in QEMU before 2.4, when built with the Firmware Configuration devic (no CVSS)
- [CVE-2016-2858](https://cve.now/CVE-2016-2858.md): QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service ( (no CVSS)
- [CVE-2016-3973](https://cve.now/CVE-2016-3973.md): The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers (no CVSS)
- [CVE-2016-3974](https://cve.now/CVE-2016-3974.md): XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to caus (no CVSS)
- [CVE-2016-3975](https://cve.now/CVE-2016-3975.md): Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2016-3947](https://cve.now/CVE-2016-3947.md): Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 al (no CVSS)
- [CVE-2016-3948](https://cve.now/CVE-2016-3948.md): Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2016-0888](https://cve.now/CVE-2016-0888.md): EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via un (no CVSS)
- [CVE-2016-1019](https://cve.now/CVE-2016-1019.md): Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbit (CVSS 7.8, KEV)
- [CVE-2016-1563](https://cve.now/CVE-2016-1563.md): NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-04-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.