# CVEs published 2016-06-20

7 CVEs were published on June 20, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-8288](https://cve.now/CVE-2015-8288.md): NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across (no CVSS)
- [CVE-2015-8289](https://cve.now/CVE-2015-8289.md): The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows re (no CVSS)
- [CVE-2016-2362](https://cve.now/CVE-2016-2362.md): Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote att (no CVSS)
- [CVE-2016-2363](https://cve.now/CVE-2016-2363.md): Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows (no CVSS)
- [CVE-2016-2364](https://cve.now/CVE-2016-2364.md): The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key acro (no CVSS)
- [CVE-2016-2177](https://cve.now/CVE-2016-2177.md): OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a de (no CVSS)
- [CVE-2016-2178](https://cve.now/CVE-2016-2178.md): The dsa\_sign\_setup function in crypto/dsa/dsa\_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-06-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.