# CVEs published 2016-07-15 27 CVEs were published on July 15, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2015-1977](https://cve.now/CVE-2015-1977.md): Directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server (ITDS) before 6.1.0.74-ISS-ISDS-IF0074, 6.2. (no CVSS) - [CVE-2016-0269](https://cve.now/CVE-2016-0269.md): Cross-site scripting (XSS) vulnerability in IBM BigFix Platform 9.x before 9.1.8 and 9.2.x before 9.2.7 allows remote authenticated users to (no CVSS) - [CVE-2016-0330](https://cve.now/CVE-2016-0330.md): IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles password creation, whi (no CVSS) - [CVE-2016-0338](https://cve.now/CVE-2016-0338.md): IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows local users to discover cl (no CVSS) - [CVE-2016-0339](https://cve.now/CVE-2016-0339.md): IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session identifiers af (no CVSS) - [CVE-2016-0340](https://cve.now/CVE-2016-0340.md): IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, wh (no CVSS) - [CVE-2016-0357](https://cve.now/CVE-2016-0357.md): IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows remote attackers to conduc (no CVSS) - [CVE-2016-2865](https://cve.now/CVE-2016-2865.md): The GIT Integration component in IBM Rational Team Concert (RTC) 5.x before 5.0.2 iFix14 and 6.x before 6.0.1 iFix5 and Rational Collaborati (no CVSS) - [CVE-2016-5637](https://cve.now/CVE-2016-5637.md): The restore\_tqb\_pixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquant\_bypass\_enable\_flag value, which allows remote attack (no CVSS) - [CVE-2016-5660](https://cve.now/CVE-2016-5660.md): Cross-site scripting (XSS) vulnerability in AttachmentsList.aspx in Accela Civic Platform Citizen Access portal allows remote attackers to i (no CVSS) - [CVE-2016-5661](https://cve.now/CVE-2016-5661.md): Accela Civic Platform Citizen Access portal relies on the client to restrict file types for uploads, which allows remote authenticated users (no CVSS) - [CVE-2016-1426](https://cve.now/CVE-2016-1426.md): Cisco IOS XR 5.x through 5.2.5 on NCS 6000 devices allows remote attackers to cause a denial of service (timer consumption and Route Process (no CVSS) - [CVE-2016-1446](https://cve.now/CVE-2016-1446.md): SQL injection vulnerability in Cisco WebEx Meetings Server 2.6 allows remote authenticated users to execute arbitrary SQL commands via unspe (no CVSS) - [CVE-2016-1447](https://cve.now/CVE-2016-1447.md): Cross-site scripting (XSS) vulnerability in the administrator interface in Cisco WebEx Meetings Server 2.6 allows remote attackers to inject (no CVSS) - [CVE-2016-1449](https://cve.now/CVE-2016-1449.md): Cross-site scripting (XSS) vulnerability in Cisco WebEx Meetings Server 2.6 allows remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2016-1450](https://cve.now/CVE-2016-1450.md): Cisco WebEx Meetings Server 2.6 allows remote authenticated users to conduct command-injection attacks via vectors related to an upload's fi (no CVSS) - [CVE-2016-1451](https://cve.now/CVE-2016-1451.md): Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Meeting Server (formerly Acano Conferencing Server) (no CVSS) - [CVE-2016-1452](https://cve.now/CVE-2016-1452.md): Cisco ASR 5000 devices with software 18.3 through 20.0.0 allow remote attackers to make configuration changes over SNMP by leveraging knowle (no CVSS) - [CVE-2016-1456](https://cve.now/CVE-2016-1456.md): The CLI in Cisco IOS XR 6.x through 6.0.1 allows local users to execute arbitrary OS commands in a privileged context by leveraging unspecif (no CVSS) - [CVE-2016-4372](https://cve.now/CVE-2016-4372.md): HPE iMC PLAT before 7.2 E0403P04, iMC EAD before 7.2 E0405P05, iMC APM before 7.2 E0401P04, iMC NTA before 7.2 E0401P01, iMC BIMS before 7.2 (no CVSS) - [CVE-2016-4520](https://cve.now/CVE-2016-4520.md): Schneider Electric Pelco Digital Sentry Video Management System with firmware before 7.14 has hardcoded credentials, which allows remote att (no CVSS) - [CVE-2016-4529](https://cve.now/CVE-2016-4529.md): An unspecified ActiveX control in Schneider Electric SoMachine HVAC Programming Software for M171/M172 Controllers before 2.1.0 allows remot (no CVSS) - [CVE-2016-5787](https://cve.now/CVE-2016-5787.md): General Electric (GE) Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify (no CVSS) - [CVE-2016-5790](https://cve.now/CVE-2016-5790.md): Tollgrade LightHouse SMS before 5.1 patch 3 allows remote attackers to bypass authentication and restart the software via unspecified vector (no CVSS) - [CVE-2016-5797](https://cve.now/CVE-2016-5797.md): Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the us (no CVSS) - [CVE-2016-5804](https://cve.now/CVE-2016-5804.md): Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use wea (no CVSS) - [CVE-2016-5807](https://cve.now/CVE-2016-5807.md): Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requiremen (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-07-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.