# CVEs published 2016-07-12

17 CVEs were published on July 12, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-3192](https://cve.now/CVE-2015-3192.md): Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disable (no CVSS, org.springframework:spring-web)
- [CVE-2016-2219](https://cve.now/CVE-2016-2219.md): Cross-site scripting (XSS) vulnerability in the management interface in Palo Alto Networks PAN-OS 7.x before 7.0.8 allows remote authenticat (no CVSS)
- [CVE-2016-4428](https://cve.now/CVE-2016-4428.md): Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authentica (no CVSS, horizon)
- [CVE-2016-4985](https://cve.now/CVE-2016-4985.md): The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive (no CVSS, ironic)
- [CVE-2016-4994](https://cve.now/CVE-2016-4994.md): Use-after-free vulnerability in the xcf\_load\_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2016-5009](https://cve.now/CVE-2016-5009.md): The handle\_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and (no CVSS)
- [CVE-2016-5774](https://cve.now/CVE-2016-5774.md): The HTTPS server in Blue Coat PacketShaper S-Series 11.5.x before 11.5.3.2 might allow remote attackers to obtain sensitive credentials and (no CVSS)
- [CVE-2016-5850](https://cve.now/CVE-2016-5850.md): Cross-site scripting (XSS) vulnerability in the volume backup service module in Huawei Public Cloud Solution before 1.0.5 allows remote auth (no CVSS)
- [CVE-2016-6174](https://cve.now/CVE-2016-6174.md): applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power B (no CVSS)
- [CVE-2016-1445](https://cve.now/CVE-2016-1445.md): Cisco Adaptive Security Appliance (ASA) Software 8.2 through 9.4.3.3 allows remote attackers to bypass intended ICMP Echo Reply ACLs via vec (no CVSS)
- [CVE-2016-2205](https://cve.now/CVE-2016-2205.md): Directory traversal vulnerability in the file-download configuration file in the management console in Symantec Workspace Streaming (SWS) 7. (no CVSS)
- [CVE-2016-2206](https://cve.now/CVE-2016-2206.md): The management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 and Symantec Workspace Virtua (no CVSS)
- [CVE-2016-4503](https://cve.now/CVE-2016-4503.md): Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vecto (no CVSS)
- [CVE-2016-4533](https://cve.now/CVE-2016-4533.md): Heap-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file. (no CVSS)
- [CVE-2016-4831](https://cve.now/CVE-2016-4831.md): Untrusted search path vulnerability in LINE and LINE Installer 4.7.0 and earlier on Windows allows local users to gain privileges via a Troj (no CVSS)
- [CVE-2016-5308](https://cve.now/CVE-2016-5308.md): The Client Intrusion Detection System (CIDS) driver before 15.0.6 in Symantec Endpoint Protection (SEP) and before 15.1.2 in Norton Security (no CVSS)
- [CVE-2016-5781](https://cve.now/CVE-2016-5781.md): Stack-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-07-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.