# CVEs published 2016-08-25

8 CVEs were published on August 25, 2016: 0 critical, 2 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2016-4655](https://cve.now/CVE-2016-4655.md): The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app. (CVSS 5.5, KEV)
- [CVE-2016-4656](https://cve.now/CVE-2016-4656.md): The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory (CVSS 7.8, KEV)
- [CVE-2016-4657](https://cve.now/CVE-2016-4657.md): WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a cr (CVSS 8.8, KEV)
- [CVE-2016-5673](https://cve.now/CVE-2016-5673.md): UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, which allows remote attackers to obtain open-proxy fu (no CVSS)
- [CVE-2016-5681](https://cve.now/CVE-2016-5681.md): Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR (no CVSS)
- [CVE-2016-6369](https://cve.now/CVE-2016-6369.md): Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain p (no CVSS)
- [CVE-2016-4069](https://cve.now/CVE-2016-4069.md): Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of us (no CVSS)
- [CVE-2016-6231](https://cve.now/CVE-2016-6231.md): Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obt (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-08-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.