# CVEs published 2016-09-12 24 CVEs were published on September 12, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2016-0331](https://cve.now/CVE-2016-0331.md): Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 6.0.1 and 6.0.2 before 6.0.2 iFix2 and Rational Collaborative Lifecycl (no CVSS) - [CVE-2016-4852](https://cve.now/CVE-2016-4852.md): YoruFukurou (NightOwl) before 2.85 relies on support for emoji skin-tone modifiers even though this support is missing from the CoreText CTF (no CVSS) - [CVE-2016-5927](https://cve.now/CVE-2016-5927.md): IBM Tivoli Storage Manager for Space Management (aka Spectrum Protect for Space Management) 6.3.x before 6.3.2.6, 6.4.x before 6.4.3.3, and (no CVSS) - [CVE-2016-5954](https://cve.now/CVE-2016-5954.md): IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF30, 8.0.0 through 8.0.0.1 CF21, and 8.5 (no CVSS) - [CVE-2016-6370](https://cve.now/CVE-2016-6370.md): Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allow (no CVSS) - [CVE-2016-6371](https://cve.now/CVE-2016-6371.md): Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allow (no CVSS) - [CVE-2016-6394](https://cve.now/CVE-2016-6394.md): Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attacker (no CVSS) - [CVE-2016-6395](https://cve.now/CVE-2016-6395.md): Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT (no CVSS) - [CVE-2016-6396](https://cve.now/CVE-2016-6396.md): Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1, when certain malware blocking options are enabled, al (no CVSS) - [CVE-2016-6398](https://cve.now/CVE-2016-6398.md): The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive informa (no CVSS) - [CVE-2016-6399](https://cve.now/CVE-2016-6399.md): Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote (no CVSS) - [CVE-2016-1469](https://cve.now/CVE-2016-1469.md): The HTTP framework on Cisco SPA300, SPA500, and SPA51x devices allows remote attackers to cause a denial of service (device outage) via a se (no CVSS) - [CVE-2016-6375](https://cve.now/CVE-2016-6375.md): Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0, 8.1.x and 8.2.x before 8.2.121.0, and 8.3.x before 8.3.102.0 allow remote atta (no CVSS) - [CVE-2016-7124](https://cve.now/CVE-2016-7124.md): ext/standard/var\_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers (no CVSS) - [CVE-2016-7125](https://cve.now/CVE-2016-7125.md): ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which (no CVSS) - [CVE-2016-7126](https://cve.now/CVE-2016-7126.md): The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colo (no CVSS) - [CVE-2016-7127](https://cve.now/CVE-2016-7127.md): The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allo (no CVSS) - [CVE-2016-7128](https://cve.now/CVE-2016-7128.md): The exif\_process\_IFD\_in\_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offse (no CVSS) - [CVE-2016-7129](https://cve.now/CVE-2016-7129.md): The php\_wddx\_process\_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial o (no CVSS) - [CVE-2016-7130](https://cve.now/CVE-2016-7130.md): The php\_wddx\_pop\_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of (no CVSS) - [CVE-2016-7131](https://cve.now/CVE-2016-7131.md): ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference an (no CVSS) - [CVE-2016-7132](https://cve.now/CVE-2016-7132.md): ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference an (no CVSS) - [CVE-2016-7133](https://cve.now/CVE-2016-7133.md): Zend/zend\_alloc.c in PHP 7.x before 7.0.10, when open\_basedir is enabled, mishandles huge realloc operations, which allows remote attackers (no CVSS) - [CVE-2016-7134](https://cve.now/CVE-2016-7134.md): ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a deni (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-09-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.