# CVEs published 2016-08-08 27 CVEs were published on August 8, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2016-0266](https://cve.now/CVE-2016-0266.md): IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attacker (no CVSS) - [CVE-2016-0280](https://cve.now/CVE-2016-0280.md): Cross-site scripting (XSS) vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Se (no CVSS) - [CVE-2016-0281](https://cve.now/CVE-2016-0281.md): The mustendd driver in IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x, when the jumbo\_frames feature is not enabled, allows remote attackers (no CVSS) - [CVE-2016-0361](https://cve.now/CVE-2016-0361.md): IBM General Parallel File System (GPFS) 3.5 before 3.5.0.29 efix 6 and 4.1.1 before 4.1.1.4 efix 9, when the Spectrum Scale GUI is used with (no CVSS) - [CVE-2016-0380](https://cve.now/CVE-2016-0380.md): IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, wh (no CVSS) - [CVE-2016-2875](https://cve.now/CVE-2016-2875.md): IBM Security QRadar SIEM 7.1.x and 7.2.x before 7.2.7 allows remote authenticated users to execute arbitrary OS commands as root via unspeci (no CVSS) - [CVE-2016-2912](https://cve.now/CVE-2016-2912.md): Cross-site scripting (XSS) vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows r (no CVSS) - [CVE-2016-2914](https://cve.now/CVE-2016-2914.md): Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows rem (no CVSS) - [CVE-2016-2925](https://cve.now/CVE-2016-2925.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0 (no CVSS) - [CVE-2016-2960](https://cve.now/CVE-2016-2960.md): IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty b (no CVSS) - [CVE-2016-2989](https://cve.now/CVE-2016-2989.md): Open redirect vulnerability in the Connections Portlets component 5.x before 5.0.2 for IBM WebSphere Portal allows remote attackers to redir (no CVSS) - [CVE-2016-3054](https://cve.now/CVE-2016-3054.md): Cross-site scripting (XSS) vulnerability in IBM FileNet Workplace 4.0.2 allows remote authenticated users to inject arbitrary web script or (no CVSS) - [CVE-2016-3059](https://cve.now/CVE-2016-3059.md): IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka IBM Spectrum Protect for Databases) 6.3 before 6.3.1 (no CVSS) - [CVE-2016-5330](https://cve.now/CVE-2016-5330.md): Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware W (no CVSS) - [CVE-2016-5331](https://cve.now/CVE-2016-5331.md): CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers an (no CVSS) - [CVE-2016-5878](https://cve.now/CVE-2016-5878.md): Open redirect vulnerability in IBM FileNet Workplace 4.0.2 before 4.0.2.14 allows remote authenticated users to redirect users to arbitrary (no CVSS) - [CVE-2015-6396](https://cve.now/CVE-2015-6396.md): The CLI command parser on Cisco RV110W, RV130W, and RV215W devices allows local users to execute arbitrary shell commands as an administrato (no CVSS) - [CVE-2015-6397](https://cve.now/CVE-2015-6397.md): Cisco RV110W, RV130W, and RV215W devices have an incorrect RBAC configuration for the default account, which allows remote authenticated use (no CVSS) - [CVE-2016-1429](https://cve.now/CVE-2016-1429.md): Directory traversal vulnerability in the web interface on Cisco RV180 and RV180W devices allows remote attackers to read arbitrary files via (no CVSS) - [CVE-2016-1430](https://cve.now/CVE-2016-1430.md): Cisco RV180 and RV180W devices allow remote authenticated users to execute arbitrary commands as root via a crafted HTTP request, aka Bug ID (no CVSS) - [CVE-2016-1466](https://cve.now/CVE-2016-1466.md): Cisco Unified Communications Manager IM and Presence Service 9.1(1) SU6, 9.1(1) SU6a, 9.1(1) SU7, 10.5(2) SU2, 10.5(2) SU2a, 11.0(1) SU1, an (no CVSS) - [CVE-2016-1468](https://cve.now/CVE-2016-1468.md): The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authenticated users to exe (no CVSS) - [CVE-2016-1474](https://cve.now/CVE-2016-1474.md): Cisco Prime Infrastructure 2.2(2) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct c (no CVSS) - [CVE-2016-1478](https://cve.now/CVE-2016-1478.md): Cisco IOS 15.5(3)S3, 15.6(1)S2, 15.6(2)S1, and 15.6(2)T1 does not properly dequeue invalid NTP packets, which allows remote attackers to cau (no CVSS) - [CVE-2016-4374](https://cve.now/CVE-2016-4374.md): HPE Release Control (RC) 9.13, 9.20, and 9.21 before 9.21.0005 p4 allows remote authenticated users to conduct server-side request forgery ( (no CVSS) - [CVE-2016-5792](https://cve.now/CVE-2016-5792.md): SQL injection vulnerability in Moxa SoftCMS before 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified fields. (no CVSS) - [CVE-2016-6486](https://cve.now/CVE-2016-6486.md): Siemens SINEMA Server uses weak permissions for the application folder, which allows local users to gain privileges via unspecified vectors. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-08-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.