# CVEs published 2016-07-02 21 CVEs were published on July 2, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2016-0386](https://cve.now/CVE-2016-0386.md): Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3 (no CVSS) - [CVE-2016-0387](https://cve.now/CVE-2016-0387.md): Cross-site scripting (XSS) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 (no CVSS) - [CVE-2016-0391](https://cve.now/CVE-2016-0391.md): The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which (no CVSS) - [CVE-2016-0398](https://cve.now/CVE-2016-0398.md): IBM Cognos Analytics (CA) 11.0 before 11.0.2 allows remote attackers to conduct content-spoofing attacks via a crafted URL. (no CVSS) - [CVE-2016-0399](https://cve.now/CVE-2016-0399.md): Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.9 IFIX007, and 7.6 before 7.6 (no CVSS) - [CVE-2016-0400](https://cve.now/CVE-2016-0400.md): CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8 (no CVSS) - [CVE-2016-1289](https://cve.now/CVE-2016-1289.md): The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute (no CVSS) - [CVE-2016-1408](https://cve.now/CVE-2016-1408.md): Cisco Prime Infrastructure 1.2 through 3.1 and Evolved Programmable Network Manager (EPNM) 1.2 and 2.0 allow remote authenticated users to e (no CVSS) - [CVE-2016-1416](https://cve.now/CVE-2016-1416.md): Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP authentication, which allows remote attackers to obtain a (no CVSS) - [CVE-2016-1440](https://cve.now/CVE-2016-1440.md): The proxy process on Cisco Web Security Appliance (WSA) devices through 9.1.0-070 allows remote attackers to cause a denial of service (CPU (no CVSS) - [CVE-2016-2861](https://cve.now/CVE-2016-2861.md): IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt (no CVSS) - [CVE-2016-2867](https://cve.now/CVE-2016-2867.md): IBM InfoSphere Streams before 4.0.1.2 and IBM Streams before 4.1.1.1 do not properly implement the runAsUser feature, which allows local use (no CVSS) - [CVE-2016-2868](https://cve.now/CVE-2016-2868.md): IBM Security QRadar SIEM 7.2.x before 7.2.7 allows remote authenticated administrators to read arbitrary files via XML data containing an ex (no CVSS) - [CVE-2016-2870](https://cve.now/CVE-2016-2870.md): Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of ser (no CVSS) - [CVE-2016-2872](https://cve.now/CVE-2016-2872.md): Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.7 and QRadar Incident Forensics 7.2.x before 7.2.7 allows rem (no CVSS) - [CVE-2016-2882](https://cve.now/CVE-2016-2882.md): IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to obtain (no CVSS) - [CVE-2016-2883](https://cve.now/CVE-2016-2883.md): Cross-site scripting (XSS) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 (no CVSS) - [CVE-2016-2961](https://cve.now/CVE-2016-2961.md): The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows r (no CVSS) - [CVE-2016-2968](https://cve.now/CVE-2016-2968.md): IBM Security QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to bypass authentication, and obtain sensitive information (no CVSS) - [CVE-2016-3956](https://cve.now/CVE-2016-3956.md): The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before (no CVSS, npm) - [CVE-2016-4560](https://cve.now/CVE-2016-4560.md): Untrusted search path vulnerability in Flexera InstallAnywhere allows local users to gain privileges via a Trojan horse DLL in the current w (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-07-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.