# CVEs published 2016-04-25 29 CVEs were published on April 25, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2016-1185](https://cve.now/CVE-2016-1185.md): The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted applic (no CVSS) - [CVE-2016-1202](https://cve.now/CVE-2016-1202.md): Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module i (no CVSS, electron) - [CVE-2016-2331](https://cve.now/CVE-2016-2331.md): The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, whi (no CVSS) - [CVE-2016-2332](https://cve.now/CVE-2016-2332.md): flu.cgi in the web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 allows remote au (no CVSS) - [CVE-2016-2333](https://cve.now/CVE-2016-2333.md): SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 use the same hardcoded encryption key across dif (no CVSS) - [CVE-2016-2346](https://cve.now/CVE-2016-2346.md): Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers (no CVSS) - [CVE-2015-8852](https://cve.now/CVE-2015-8852.md): Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct H (no CVSS) - [CVE-2016-4051](https://cve.now/CVE-2016-4051.md): Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of serv (no CVSS) - [CVE-2016-4052](https://cve.now/CVE-2016-4052.md): Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service (no CVSS) - [CVE-2016-4053](https://cve.now/CVE-2016-4053.md): Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Inclu (no CVSS) - [CVE-2016-4054](https://cve.now/CVE-2016-4054.md): Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Incl (no CVSS) - [CVE-2016-4006](https://cve.now/CVE-2016-4006.md): epan/proto.c in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not limit the protocol-tree depth, which allows remote attackers (no CVSS) - [CVE-2016-4076](https://cve.now/CVE-2016-4076.md): epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 2.0.x before 2.0.3 does not properly initialize memory for search patte (no CVSS) - [CVE-2016-4077](https://cve.now/CVE-2016-4077.md): epan/reassemble.c in TShark in Wireshark 2.0.x before 2.0.3 relies on incorrect special-case handling of truncated Tvb data structures, whic (no CVSS) - [CVE-2016-4078](https://cve.now/CVE-2016-4078.md): The IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not properly restrict element lists, which allows r (no CVSS) - [CVE-2016-4079](https://cve.now/CVE-2016-4079.md): epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not verify BER identifier (no CVSS) - [CVE-2016-4080](https://cve.now/CVE-2016-4080.md): epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 misparses timestamp fields, wh (no CVSS) - [CVE-2016-4081](https://cve.now/CVE-2016-4081.md): epan/dissectors/packet-iax2.c in the IAX2 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses an incorrect integer data (no CVSS) - [CVE-2016-4082](https://cve.now/CVE-2016-4082.md): epan/dissectors/packet-gsm\_cbch.c in the GSM CBCH dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses the wrong variabl (no CVSS) - [CVE-2016-4083](https://cve.now/CVE-2016-4083.md): epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 does not ensure that data is available before array a (no CVSS) - [CVE-2016-4084](https://cve.now/CVE-2016-4084.md): Integer signedness error in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 allows remote attackers t (no CVSS) - [CVE-2016-4085](https://cve.now/CVE-2016-4085.md): Stack-based buffer overflow in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.12.x before 1.12.11 allows remote atta (no CVSS) - [CVE-2015-5370](https://cve.now/CVE-2015-5370.md): Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remo (no CVSS) - [CVE-2016-2110](https://cve.now/CVE-2016-2110.md): The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-m (no CVSS) - [CVE-2016-2111](https://cve.now/CVE-2016-2111.md): The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, (no CVSS) - [CVE-2016-2112](https://cve.now/CVE-2016-2112.md): The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "clien (no CVSS) - [CVE-2016-2113](https://cve.now/CVE-2016-2113.md): Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in (no CVSS) - [CVE-2016-2114](https://cve.now/CVE-2016-2114.md): The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signi (no CVSS) - [CVE-2016-2115](https://cve.now/CVE-2016-2115.md): Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn\_ (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-04-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.