# CVEs published 2016-07-04

12 CVEs were published on July 4, 2016: 0 critical, 1 high. Days are UTC.

- [CVE-2015-0899](https://cve.now/CVE-2015-0899.md): The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions v (no CVSS, org.apache.struts:struts-core · struts:struts)
- [CVE-2016-1181](https://cve.now/CVE-2016-1181.md): ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote atta (no CVSS, org.apache.struts:struts-core · struts:struts)
- [CVE-2016-1182](https://cve.now/CVE-2016-1182.md): ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attacke (no CVSS, org.apache.struts:struts-core · struts:struts)
- [CVE-2016-3092](https://cve.now/CVE-2016-3092.md): The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x be (CVSS 7.5, commons-fileupload:commons-fileupload)
- [CVE-2016-4430](https://cve.now/CVE-2016-4430.md): Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CS (no CVSS, org.apache.struts.xwork:xwork-core)
- [CVE-2016-4431](https://cve.now/CVE-2016-4431.md): Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by le (no CVSS, org.apache.struts:struts-parent)
- [CVE-2016-4433](https://cve.now/CVE-2016-4433.md): Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a (no CVSS, org.apache.struts.xwork:xwork-core)
- [CVE-2016-4438](https://cve.now/CVE-2016-4438.md): The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression. (no CVSS, org.apache.struts:struts2-core · org.apache.struts:struts2-…)
- [CVE-2016-4465](https://cve.now/CVE-2016-4465.md): The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of servic (no CVSS, org.apache.struts:struts2-core)
- [CVE-2016-0899](https://cve.now/CVE-2016-0899.md): EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential i (no CVSS)
- [CVE-2016-5848](https://cve.now/CVE-2016-5848.md): Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate p (no CVSS)
- [CVE-2016-5849](https://cve.now/CVE-2016-5849.md): Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-07-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.