# CVEs published 2016-05-14

25 CVEs were published on May 14, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-1660](https://cve.now/CVE-2016-1660.md): Blink, as used in Google Chrome before 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double\_conversion::Vector classes, (no CVSS)
- [CVE-2016-1661](https://cve.now/CVE-2016-1661.md): Blink, as used in Google Chrome before 50.0.2661.94, does not ensure that frames satisfy a check for the same renderer process in addition t (no CVSS)
- [CVE-2016-1662](https://cve.now/CVE-2016-1662.md): extensions/renderer/gc\_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection call (no CVSS)
- [CVE-2016-1663](https://cve.now/CVE-2016-1663.md): The SerializedScriptValue::transferArrayBuffers function in WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp in the V8 bindings in B (no CVSS)
- [CVE-2016-1664](https://cve.now/CVE-2016-1664.md): The HistoryController::UpdateForCommit function in content/renderer/history\_controller.cc in Google Chrome before 50.0.2661.94 mishandles th (no CVSS)
- [CVE-2016-1665](https://cve.now/CVE-2016-1665.md): The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8, as used in Google Chrome before 50.0.2661.94, mishandles compar (no CVSS)
- [CVE-2016-1666](https://cve.now/CVE-2016-1666.md): Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attackers to cause a denial of service or possibly have othe (no CVSS)
- [CVE-2016-1667](https://cve.now/CVE-2016-1667.md): The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome b (no CVSS)
- [CVE-2016-1668](https://cve.now/CVE-2016-1668.md): The forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h in the V8 bindings in Blink, as used in Google Chrome before 50. (no CVSS)
- [CVE-2016-1669](https://cve.now/CVE-2016-1669.md): The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine (no CVSS)
- [CVE-2016-1670](https://cve.now/CVE-2016-1670.md): Race condition in the ResourceDispatcherHostImpl::BeginRequest function in content/browser/loader/resource\_dispatcher\_host\_impl.cc in Google (no CVSS)
- [CVE-2016-1671](https://cve.now/CVE-2016-1671.md): Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \\ (backslash) characters, which allows attackers to conduct directory (no CVSS)
- [CVE-2016-1206](https://cve.now/CVE-2016-1206.md): The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which all (no CVSS)
- [CVE-2016-1207](https://cve.now/CVE-2016-1207.md): Cross-site scripting (XSS) vulnerability on I-O DATA DEVICE WN-G300R devices with firmware 1.12 and earlier, WN-G300R2 devices with firmware (no CVSS)
- [CVE-2016-2296](https://cve.now/CVE-2016-2296.md): Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows rem (no CVSS)
- [CVE-2016-2297](https://cve.now/CVE-2016-2297.md): Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to execute arbitrary commands via an "access command s (no CVSS)
- [CVE-2016-2298](https://cve.now/CVE-2016-2298.md): Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited allows remote attackers to obtain sensitive cleartext information via unspecif (no CVSS)
- [CVE-2016-4325](https://cve.now/CVE-2016-4325.md): Lantronix xPrintServer devices with firmware before 5.0.1-65 have hardcoded credentials, which allows remote attackers to obtain root access (no CVSS)
- [CVE-2015-8530](https://cve.now/CVE-2015-8530.md): Stack-based buffer overflow in the Initialize function in an ActiveX control in IBM SPSS Statistics 19 and 20 before 20.0.0.2-IF0008, 21 bef (no CVSS)
- [CVE-2016-1208](https://cve.now/CVE-2016-1208.md): The server in Apple FileMaker before 14.0.4 on OS X allows remote attackers to read PHP source code via unspecified vectors. (no CVSS)
- [CVE-2016-1209](https://cve.now/CVE-2016-1209.md): The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized (no CVSS)
- [CVE-2016-2015](https://cve.now/CVE-2016-2015.md): HPE System Management Homepage before 7.5.5 allows local users to obtain sensitive information or modify data via unspecified vectors. (no CVSS)
- [CVE-2016-2016](https://cve.now/CVE-2016-2016.md): Base-VxFS-50 B.05.00.01 through B.05.00.02, Base-VxFS-501 B.05.01.0 through B.05.01.03, and Base-VxFS-51 B.05.10.00 through B.05.10.02 on HP (no CVSS)
- [CVE-2015-8156](https://cve.now/CVE-2015-8156.md): Unquoted Windows search path vulnerability in EEDService in Symantec Endpoint Encryption (SEE) 11.x before 11.1.1 allows local users to gain (no CVSS)
- [CVE-2016-1399](https://cve.now/CVE-2016-1399.md): The packet-processing microcode in Cisco IOS 15.2(2)EA, 15.2(2)EA1, 15.2(2)EA2, and 15.2(4)EA on Industrial Ethernet 4000 devices and 15.2(2 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.