# CVEs published 2016-06-30

42 CVEs were published on June 30, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-8801](https://cve.now/CVE-2015-8801.md): Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on (no CVSS)
- [CVE-2016-2207](https://cve.now/CVE-2016-2207.md): The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 (no CVSS)
- [CVE-2016-2209](https://cve.now/CVE-2016-2209.md): Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security (no CVSS)
- [CVE-2016-2210](https://cve.now/CVE-2016-2210.md): Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Securit (no CVSS)
- [CVE-2016-2211](https://cve.now/CVE-2016-2211.md): The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 (no CVSS)
- [CVE-2016-3644](https://cve.now/CVE-2016-3644.md): The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 (no CVSS)
- [CVE-2016-3645](https://cve.now/CVE-2016-3645.md): Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center (no CVSS)
- [CVE-2016-3646](https://cve.now/CVE-2016-3646.md): The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 (no CVSS)
- [CVE-2016-3647](https://cve.now/CVE-2016-3647.md): Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SS (no CVSS)
- [CVE-2016-3648](https://cve.now/CVE-2016-3648.md): Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protecti (no CVSS)
- [CVE-2016-3649](https://cve.now/CVE-2016-3649.md): Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accoun (no CVSS)
- [CVE-2016-3650](https://cve.now/CVE-2016-3650.md): Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force (no CVSS)
- [CVE-2016-3651](https://cve.now/CVE-2016-3651.md): Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via u (no CVSS)
- [CVE-2016-3652](https://cve.now/CVE-2016-3652.md): Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 (no CVSS)
- [CVE-2016-3653](https://cve.now/CVE-2016-3653.md): Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before (no CVSS)
- [CVE-2016-5304](https://cve.now/CVE-2016-5304.md): Open redirect vulnerability in a report-routing component in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote a (no CVSS)
- [CVE-2016-5305](https://cve.now/CVE-2016-5305.md): Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 (no CVSS)
- [CVE-2016-5306](https://cve.now/CVE-2016-5306.md): Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 does not properly implement the HSTS protection mechanism, which makes it ea (no CVSS)
- [CVE-2016-5307](https://cve.now/CVE-2016-5307.md): Directory traversal vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to re (no CVSS)
- [CVE-2015-8899](https://cve.now/CVE-2015-8899.md): Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2 (no CVSS)
- [CVE-2016-3189](https://cve.now/CVE-2016-3189.md): Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 (CVSS 6.5)
- [CVE-2016-4309](https://cve.now/CVE-2016-4309.md): Session fixation vulnerability in Symphony CMS 2.6.7, when session.use\_only\_cookies is disabled, allows remote attackers to hijack web sessi (no CVSS)
- [CVE-2016-4472](https://cve.now/CVE-2016-4472.md): The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial (no CVSS)
- [CVE-2016-4803](https://cve.now/CVE-2016-4803.md): CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email header (no CVSS)
- [CVE-2016-4971](https://cve.now/CVE-2016-4971.md): GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. (no CVSS)
- [CVE-2016-5020](https://cve.now/CVE-2016-5020.md): F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration (no CVSS)
- [CVE-2016-5301](https://cve.now/CVE-2016-5301.md): The parse\_chunk\_header function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted (1) HT (no CVSS)
- [CVE-2016-5360](https://cve.now/CVE-2016-5360.md): HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memor (no CVSS)
- [CVE-2016-4057](https://cve.now/CVE-2016-4057.md): Huawei FusionCompute before V100R005C10SPC700 allows remote authenticated users to cause a denial of service (resource consumption) via a la (no CVSS)
- [CVE-2016-4086](https://cve.now/CVE-2016-4086.md): Huawei HiSuite (In China) before 4.0.4.301 and (Out of China) before 4.0.4.204\_ove allows remote attackers to install arbitrary apps on a co (no CVSS)
- [CVE-2016-4474](https://cve.now/CVE-2016-4474.md): The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack (no CVSS)
- [CVE-2016-5230](https://cve.now/CVE-2016-5230.md): Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 (no CVSS)
- [CVE-2016-5231](https://cve.now/CVE-2016-5231.md): Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 (no CVSS)
- [CVE-2016-5232](https://cve.now/CVE-2016-5232.md): Buffer overflow in Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL befo (no CVSS)
- [CVE-2016-5248](https://cve.now/CVE-2016-5248.md): The StopProxy command in LSC.Services.SystemService in Lenovo Solution Center before 3.3.003 allows local users to terminate arbitrary proce (no CVSS)
- [CVE-2016-5249](https://cve.now/CVE-2016-5249.md): Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving t (no CVSS)
- [CVE-2016-5368](https://cve.now/CVE-2016-5368.md): Memory leak in Huawei AR3200 before V200R007C00SPC900 allows remote attackers to cause a denial of service (memory consumption) via a large (no CVSS)
- [CVE-2016-5729](https://cve.now/CVE-2016-5729.md): Lenovo BIOS EFI Driver allows local administrators to execute arbitrary code with System Management Mode (SMM) privileges via unspecified ve (no CVSS)
- [CVE-2016-5840](https://cve.now/CVE-2016-5840.md): hotfix\_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to exec (no CVSS)
- [CVE-2016-0322](https://cve.now/CVE-2016-0322.md): Cross-site scripting (XSS) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 through CR4, and 5.5 before CR1 allows rem (no CVSS)
- [CVE-2016-0349](https://cve.now/CVE-2016-0349.md): IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended acce (no CVSS)
- [CVE-2016-2141](https://cve.now/CVE-2016-2141.md): It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. (no CVSS, org.jgroups:jgroups)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-06-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.