# CVEs published 2016-09-17

16 CVEs were published on September 17, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-1482](https://cve.now/CVE-2016-1482.md): Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script (no CVSS)
- [CVE-2016-6644](https://cve.now/CVE-2016-6644.md): EMC Documentum D2 4.5 before patch 15 and 4.6 before patch 03 allows remote attackers to read arbitrary Docbase documents by leveraging know (no CVSS)
- [CVE-2016-7411](https://cve.now/CVE-2016-7411.md): ext/standard/var\_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a d (no CVSS)
- [CVE-2016-7412](https://cve.now/CVE-2016-7412.md): ext/mysqlnd/mysqlnd\_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED\_FLAG flag, w (no CVSS)
- [CVE-2016-7413](https://cve.now/CVE-2016-7413.md): Use-after-free vulnerability in the wddx\_stack\_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote (no CVSS)
- [CVE-2016-7414](https://cve.now/CVE-2016-7414.md): The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed\_filesize field is la (no CVSS)
- [CVE-2016-7415](https://cve.now/CVE-2016-7415.md): Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ all (no CVSS)
- [CVE-2016-7416](https://cve.now/CVE-2016-7416.md): ext/intl/msgformat/msgformat\_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to th (no CVSS)
- [CVE-2016-7417](https://cve.now/CVE-2016-7417.md): ext/spl/spl\_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and (no CVSS)
- [CVE-2016-7418](https://cve.now/CVE-2016-7418.md): The php\_wddx\_push\_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2016-7419](https://cve.now/CVE-2016-7419.md): Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before (no CVSS)
- [CVE-2016-5843](https://cve.now/CVE-2016-5843.md): Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request Sy (no CVSS)
- [CVE-2016-6401](https://cve.now/CVE-2016-6401.md): Cisco Carrier Routing System (CRS) 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers (no CVSS)
- [CVE-2016-6407](https://cve.now/CVE-2016-6407.md): Cisco AsyncOS through 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturatio (no CVSS)
- [CVE-2016-6937](https://cve.now/CVE-2016-6937.md): Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Contin (no CVSS)
- [CVE-2016-6938](https://cve.now/CVE-2016-6938.md): Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acro (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-09-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.