# CVEs published 2016-04-08

31 CVEs were published on April 8, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-5158](https://cve.now/CVE-2015-5158.md): Stack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU, when built with SCSI-device emulation support, allows guest OS users with CAP\_SYS (no CVSS)
- [CVE-2015-8108](https://cve.now/CVE-2015-8108.md): The management interface in LenovoEMC EZ Media & Backup (hm3), ix2/ix2-dl, ix4-300d, px12-400r/450r, px6-300d, px2-300d, px4-300r, px4-400d, (no CVSS)
- [CVE-2015-8833](https://cve.now/CVE-2015-8833.md): Use-after-free vulnerability in the create\_smp\_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin befor (no CVSS)
- [CVE-2015-8841](https://cve.now/CVE-2015-8841.md): Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2016-1568](https://cve.now/CVE-2016-1568.md): Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial o (no CVSS)
- [CVE-2016-1885](https://cve.now/CVE-2016-1885.md): Integer signedness error in the amd64\_set\_ldt function in sys/amd64/amd64/sys\_machdep.c in FreeBSD 9.3 before p39, 10.1 before p31, and 10.2 (no CVSS)
- [CVE-2016-2857](https://cve.now/CVE-2016-2857.md): The net\_checksum\_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap r (no CVSS)
- [CVE-2016-3985](https://cve.now/CVE-2016-3985.md): The Terminal Services Remote Desktop Protocol (RDP) client session restrictions feature in Pulse Connect Secure (aka PCS) 8.1R7 and 8.2R1 al (no CVSS)
- [CVE-2016-3986](https://cve.now/CVE-2016-3986.md): Avast allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted PE file, re (no CVSS)
- [CVE-2016-3987](https://cve.now/CVE-2016-3987.md): The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/ope (no CVSS)
- [CVE-2015-5229](https://cve.now/CVE-2015-5229.md): The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which mig (no CVSS)
- [CVE-2015-5969](https://cve.now/CVE-2015-5969.md): The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSU (no CVSS)
- [CVE-2016-1180](https://cve.now/CVE-2016-1180.md): Cross-site scripting (XSS) vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attacker (no CVSS)
- [CVE-2016-1375](https://cve.now/CVE-2016-1375.md): Cross-site scripting (XSS) vulnerability in Cisco IP Interoperability and Collaboration System 4.10(1) allows remote attackers to inject arb (no CVSS)
- [CVE-2016-2381](https://cve.now/CVE-2016-2381.md): Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables (no CVSS)
- [CVE-2016-2512](https://cve.now/CVE-2016-2512.md): The utils.http.is\_safe\_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary we (no CVSS, django)
- [CVE-2016-2513](https://cve.now/CVE-2016-2513.md): The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via (no CVSS, django)
- [CVE-2016-3963](https://cve.now/CVE-2016-3963.md): Siemens SCALANCE S613 allows remote attackers to cause a denial of service (web-server outage) via traffic to TCP port 443. (no CVSS)
- [CVE-2016-3983](https://cve.now/CVE-2016-3983.md): McAfee Advanced Threat Defense (ATD) before 3.4.8.178 might allow remote attackers to bypass malware detection by leveraging information abo (no CVSS)
- [CVE-2016-3984](https://cve.now/CVE-2016-3984.md): The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5. (no CVSS)
- [CVE-2015-6541](https://cve.now/CVE-2015-6541.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remot (no CVSS)
- [CVE-2016-2315](https://cve.now/CVE-2016-2315.md): revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long f (no CVSS)
- [CVE-2016-2324](https://cve.now/CVE-2016-2324.md): Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, whi (no CVSS)
- [CVE-2016-3153](https://cve.now/CVE-2016-3153.md): SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, (no CVSS)
- [CVE-2016-3154](https://cve.now/CVE-2016-3154.md): The encoder\_contexte\_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows r (no CVSS)
- [CVE-2016-3187](https://cve.now/CVE-2016-3187.md): The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently h (no CVSS)
- [CVE-2016-3188](https://cve.now/CVE-2016-3188.md): The \_prepopulate\_request\_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) (no CVSS)
- [CVE-2016-3978](https://cve.now/CVE-2016-3978.md): The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirec (no CVSS)
- [CVE-2016-3979](https://cve.now/CVE-2016-3979.md): Internet Communication Manager (aka ICMAN or ICM) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (heap (no CVSS)
- [CVE-2016-3980](https://cve.now/CVE-2016-3980.md): The Java Startup Framework (aka jstart) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (process crash) (no CVSS)
- [CVE-2015-8840](https://cve.now/CVE-2015-8840.md): The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to o (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-04-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.