# CVEs published 2016-09-07

37 CVEs were published on September 7, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-8948](https://cve.now/CVE-2015-8948.md): idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which tri (no CVSS)
- [CVE-2016-5404](https://cve.now/CVE-2016-5404.md): The cert\_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke (no CVSS)
- [CVE-2016-6179](https://cve.now/CVE-2016-6179.md): The WiFi driver in Huawei Honor 6 smartphones with software H60-L01 before H60-L01C00B850, H60-L11 before H60-L11C00B850, H60-L21 before H60 (no CVSS)
- [CVE-2016-6261](https://cve.now/CVE-2016-6261.md): The idna\_to\_ascii\_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bo (no CVSS)
- [CVE-2016-6262](https://cve.now/CVE-2016-6262.md): idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which trigger (no CVSS)
- [CVE-2016-6263](https://cve.now/CVE-2016-6263.md): The stringprep\_utf8\_nfkc\_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of serv (no CVSS)
- [CVE-2016-1241](https://cve.now/CVE-2016-1241.md): Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated user (no CVSS, trytond · tryton)
- [CVE-2016-1242](https://cve.now/CVE-2016-1242.md): file\_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenti (no CVSS, trytond · tryton)
- [CVE-2016-5022](https://cve.now/CVE-2016-5022.md): F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 1 (no CVSS)
- [CVE-2016-5422](https://cve.now/CVE-2016-5422.md): The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user (no CVSS)
- [CVE-2016-6180](https://cve.now/CVE-2016-6180.md): The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and C (no CVSS)
- [CVE-2016-6181](https://cve.now/CVE-2016-6181.md): The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and C (no CVSS)
- [CVE-2016-6182](https://cve.now/CVE-2016-6182.md): The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and C (no CVSS)
- [CVE-2016-6183](https://cve.now/CVE-2016-6183.md): The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and C (no CVSS)
- [CVE-2016-6184](https://cve.now/CVE-2016-6184.md): The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and C (no CVSS)
- [CVE-2016-6316](https://cve.now/CVE-2016-6316.md): Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 mig (no CVSS, actionview)
- [CVE-2016-6317](https://cve.now/CVE-2016-6317.md): Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record c (no CVSS, activerecord)
- [CVE-2016-6318](https://cve.now/CVE-2016-6318.md): Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (a (no CVSS)
- [CVE-2016-6670](https://cve.now/CVE-2016-6670.md): Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to genera (no CVSS)
- [CVE-2016-6825](https://cve.now/CVE-2016-6825.md): Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SP (no CVSS)
- [CVE-2016-6838](https://cve.now/CVE-2016-6838.md): Huawei X6800 and XH620 V3 servers with software before V100R003C00SPC606, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V (no CVSS)
- [CVE-2016-6839](https://cve.now/CVE-2016-6839.md): CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct (no CVSS)
- [CVE-2016-6876](https://cve.now/CVE-2016-6876.md): The RESOLV::lookup iRule command in F5 BIG-IP LTM, APM, ASM, and Link Controller 10.2.1 through 10.2.4, 11.2.1, 11.4.x, 11.5.x before 11.5.4 (no CVSS)
- [CVE-2016-6898](https://cve.now/CVE-2016-6898.md): XML external entity (XXE) vulnerability in the Hyper Management Module (HMM) in Huawei E9000 rack servers with software before V100R001C00SP (no CVSS)
- [CVE-2016-6899](https://cve.now/CVE-2016-6899.md): The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers (no CVSS)
- [CVE-2016-6900](https://cve.now/CVE-2016-6900.md): The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613; RH2288 V3 servers (no CVSS)
- [CVE-2016-7107](https://cve.now/CVE-2016-7107.md): Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequ (no CVSS)
- [CVE-2016-7108](https://cve.now/CVE-2016-7108.md): Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitra (no CVSS)
- [CVE-2016-7109](https://cve.now/CVE-2016-7109.md): Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special character (no CVSS)
- [CVE-2016-7110](https://cve.now/CVE-2016-7110.md): Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special character (no CVSS)
- [CVE-2016-6344](https://cve.now/CVE-2016-6344.md): Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remot (no CVSS)
- [CVE-2016-6345](https://cve.now/CVE-2016-6345.md): RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs. (no CVSS, org.jboss.resteasy:resteasy-client)
- [CVE-2016-6346](https://cve.now/CVE-2016-6346.md): RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors. (no CVSS, org.jboss.resteasy:resteasy-jaxrs)
- [CVE-2016-6351](https://cve.now/CVE-2016-6351.md): The esp\_do\_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows loc (no CVSS)
- [CVE-2016-6855](https://cve.now/CVE-2016-6855.md): Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remo (no CVSS)
- [CVE-2016-7033](https://cve.now/CVE-2016-7033.md): Multiple cross-site scripting (XSS) vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attacker (no CVSS)
- [CVE-2016-7034](https://cve.now/CVE-2016-7034.md): The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them i (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-09-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.