# CVEs published 2016-05-17

13 CVEs were published on May 17, 2016: 0 critical, 1 high. Days are UTC.

- [CVE-2016-0306](https://cve.now/CVE-2016-0306.md): IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, miscon (no CVSS)
- [CVE-2016-0323](https://cve.now/CVE-2016-0323.md): The Auto-Scaling agent in Liberty for Java in IBM Bluemix before 2.7-20160321-1358 allows remote authenticated users to disable X.509 certif (no CVSS)
- [CVE-2016-3627](https://cve.now/CVE-2016-3627.md): The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to (CVSS 7.5)
- [CVE-2016-3674](https://cve.now/CVE-2016-3674.md): Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (no CVSS, com.thoughtworks.xstream:xstream)
- [CVE-2016-3705](https://cve.now/CVE-2016-3705.md): The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recurs (no CVSS)
- [CVE-2016-3722](https://cve.now/CVE-2016-3722.md): Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to lo (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-3723](https://cve.now/CVE-2016-3723.md): Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation informat (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-3724](https://cve.now/CVE-2016-3724.md): Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password informatio (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-3725](https://cve.now/CVE-2016-3725.md): Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a miss (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-3726](https://cve.now/CVE-2016-3726.md): Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary we (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-3727](https://cve.now/CVE-2016-3727.md): The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read perm (no CVSS, org.jenkins-ci.main:jenkins-core)
- [CVE-2016-4425](https://cve.now/CVE-2016-4425.md): Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via c (CVSS 6.5)
- [CVE-2016-3721](https://cve.now/CVE-2016-3721.md): Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environ (CVSS 4.3, org.jenkins-ci.main:jenkins-core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.