# CVEs published 2016-04-11

40 CVEs were published on April 11, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9759](https://cve.now/CVE-2014-9759.md): Incomplete blacklist vulnerability in the config\_is\_private function in config\_api.php in MantisBT 1.3.x before 1.3.0 allows remote attacker (no CVSS)
- [CVE-2015-5233](https://cve.now/CVE-2015-5233.md): Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view\_hosts permissions, which allows (1) remote authenticated users with t (no CVSS)
- [CVE-2015-5303](https://cve.now/CVE-2015-5303.md): The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack (no CVSS, tripleo-heat-templates)
- [CVE-2015-5313](https://cve.now/CVE-2015-5313.md): Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage\_backend\_fs.c in libvirt, when fine (no CVSS)
- [CVE-2015-5329](https://cve.now/CVE-2015-5329.md): The TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the con (no CVSS)
- [CVE-2015-5349](https://cve.now/CVE-2015-5349.md): The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow a (no CVSS, org.apache.directory.studio:org.apache.directory.studio.lda…)
- [CVE-2015-7330](https://cve.now/CVE-2015-7330.md): Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet co (no CVSS)
- [CVE-2015-7502](https://cve.now/CVE-2015-7502.md): Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the (no CVSS)
- [CVE-2015-7528](https://cve.now/CVE-2015-7528.md): Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name. (no CVSS, github.com/kubernetes/kubernetes)
- [CVE-2015-8398](https://cve.now/CVE-2015-8398.md): Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2015-8399](https://cve.now/CVE-2015-8399.md): Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spac (no CVSS)
- [CVE-2015-8604](https://cve.now/CVE-2015-8604.md): SQL injection vulnerability in the host\_new\_graphs function in graphs\_new.php in Cacti 0.8.8f and earlier allows remote authenticated users (no CVSS)
- [CVE-2015-8614](https://cve.now/CVE-2015-8614.md): Multiple stack-based buffer overflows in the (1) conv\_jistoeuc, (2) conv\_euctojis, and (3) conv\_sjistoeuc functions in codeconv.c in Claws M (no CVSS)
- [CVE-2015-8708](https://cve.now/CVE-2015-8708.md): Stack-based buffer overflow in the conv\_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified imp (no CVSS)
- [CVE-2015-8710](https://cve.now/CVE-2015-8710.md): The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of (no CVSS)
- [CVE-2015-0265](https://cve.now/CVE-2015-0265.md): Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary (no CVSS, org.apache.ranger:ranger)
- [CVE-2015-0266](https://cve.now/CVE-2015-0266.md): The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct acce (no CVSS, org.apache.ranger:ranger)
- [CVE-2016-0735](https://cve.now/CVE-2016-0735.md): Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveragin (no CVSS, org.apache.ranger:ranger)
- [CVE-2012-6698](https://cve.now/CVE-2012-6698.md): The decode\_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a craft (no CVSS)
- [CVE-2012-6699](https://cve.now/CVE-2012-6699.md): The decode\_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafte (no CVSS)
- [CVE-2012-6700](https://cve.now/CVE-2012-6700.md): The decode\_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP servers to cause a deni (no CVSS)
- [CVE-2016-1235](https://cve.now/CVE-2016-1235.md): The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privil (no CVSS)
- [CVE-2016-2193](https://cve.now/CVE-2016-2193.md): PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass i (no CVSS)
- [CVE-2016-2385](https://cve.now/CVE-2016-2385.md): Heap-based buffer overflow in the encode\_msg function in encode\_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 (no CVSS)
- [CVE-2016-3065](https://cve.now/CVE-2016-3065.md): The (1) brin\_page\_type and (2) brin\_metapage\_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows atta (no CVSS)
- [CVE-2016-3659](https://cve.now/CVE-2016-3659.md): SQL injection vulnerability in graph\_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the h (no CVSS)
- [CVE-2016-3675](https://cve.now/CVE-2016-3675.md): SQL injection vulnerability in Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to execute arbi (no CVSS)
- [CVE-2016-3676](https://cve.now/CVE-2016-3676.md): Huawei E3276s USB modems with software before E3276s-150TCPU-V200R002B436D09SP00C00 allow man-in-the-middle attackers to intercept, spoof, o (no CVSS)
- [CVE-2016-3678](https://cve.now/CVE-2016-3678.md): Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012 allow remote attackers to cause a denial o (no CVSS)
- [CVE-2015-8240](https://cve.now/CVE-2015-8240.md): The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 (no CVSS)
- [CVE-2016-0709](https://cve.now/CVE-2016-0709.md): Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote aut (no CVSS, org.apache.portals.jetspeed-2:jetspeed)
- [CVE-2016-0710](https://cve.now/CVE-2016-0710.md): Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitra (no CVSS, org.apache.portals.jetspeed-2:jetspeed)
- [CVE-2016-0711](https://cve.now/CVE-2016-0711.md): Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or (no CVSS, org.apache.portals.jetspeed-2:jetspeed-commons)
- [CVE-2016-0712](https://cve.now/CVE-2016-0712.md): Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via (no CVSS, org.apache.portals.jetspeed-2:jetspeed)
- [CVE-2016-0783](https://cve.now/CVE-2016-0783.md): The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remot (no CVSS)
- [CVE-2016-0784](https://cve.now/CVE-2016-0784.md): Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authen (no CVSS, org.apache.openmeetings:openmeetings-install)
- [CVE-2016-2163](https://cve.now/CVE-2016-2163.md): Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML (no CVSS, org.apache.openmeetings:openmeetings-parent)
- [CVE-2016-2164](https://cve.now/CVE-2016-2164.md): The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperl (no CVSS, org.apache.openmeetings:openmeetings-parent)
- [CVE-2016-2171](https://cve.now/CVE-2016-2171.md): The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote atta (no CVSS)
- [CVE-2016-2393](https://cve.now/CVE-2016-2393.md): Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, whi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-04-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.