# CVEs published 2016-09-18 28 CVEs were published on September 18, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2016-1433](https://cve.now/CVE-2016-1433.md): Cisco IOS XR 6.0 and 6.0.1 on NCS 6000 devices allows remote attackers to cause a denial of service (OSPFv3 process reload) via crafted OSPF (no CVSS) - [CVE-2016-4620](https://cve.now/CVE-2016-4620.md): The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, whi (no CVSS) - [CVE-2016-4704](https://cve.now/CVE-2016-4704.md): otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) v (no CVSS) - [CVE-2016-4705](https://cve.now/CVE-2016-4705.md): otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) v (no CVSS) - [CVE-2016-4719](https://cve.now/CVE-2016-4719.md): The GeoServices component in Apple iOS before 10 and watchOS before 3 does not properly restrict access to PlaceData information, which allo (no CVSS) - [CVE-2016-4740](https://cve.now/CVE-2016-4740.md): Apple iOS before 10, when Handoff for Messages is used, does not ensure that a Messages signin has occurred before displaying messages, whic (no CVSS) - [CVE-2016-4741](https://cve.now/CVE-2016-4741.md): The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an H (no CVSS) - [CVE-2016-4746](https://cve.now/CVE-2016-4746.md): The Keyboards component in Apple iOS before 10 does not properly use a cache for auto-correct suggestions, which allows remote attackers to (no CVSS) - [CVE-2016-4747](https://cve.now/CVE-2016-4747.md): Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via (no CVSS) - [CVE-2016-4749](https://cve.now/CVE-2016-4749.md): Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview cont (no CVSS) - [CVE-2016-6402](https://cve.now/CVE-2016-6402.md): UCS Manager and UCS 6200 Fabric Interconnects in Cisco Unified Computing System (UCS) through 3.0(2d) allow local users to obtain OS root ac (no CVSS) - [CVE-2016-6403](https://cve.now/CVE-2016-6403.md): The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause (no CVSS) - [CVE-2016-6404](https://cve.now/CVE-2016-6404.md): Cross-site scripting (XSS) vulnerability in the web framework in Cisco IOx Local Manager in IOS 15.5(2)T and IOS XE allows remote attackers (no CVSS) - [CVE-2016-6405](https://cve.now/CVE-2016-6405.md): Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via (no CVSS) - [CVE-2016-0883](https://cve.now/CVE-2016-0883.md): Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' (no CVSS) - [CVE-2016-0896](https://cve.now/CVE-2016-0896.md): Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all\_open Application Security (no CVSS) - [CVE-2016-0897](https://cve.now/CVE-2016-0897.md): Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH a (no CVSS) - [CVE-2016-0922](https://cve.now/CVE-2016-0922.md): EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to ob (no CVSS) - [CVE-2016-0923](https://cve.now/CVE-2016-0923.md): The client in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a sig (no CVSS) - [CVE-2016-0926](https://cve.now/CVE-2016-0926.md): Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 (no CVSS) - [CVE-2016-0927](https://cve.now/CVE-2016-0927.md): Cross-site scripting (XSS) vulnerability in Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 allows remote attackers to inject arbitrar (no CVSS) - [CVE-2016-0928](https://cve.now/CVE-2016-0928.md): Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote atta (no CVSS) - [CVE-2016-0929](https://cve.now/CVE-2016-0929.md): The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands, which (no CVSS) - [CVE-2016-0930](https://cve.now/CVE-2016-0930.md): Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for co (no CVSS) - [CVE-2016-6639](https://cve.now/CVE-2016-6639.md): Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF (no CVSS) - [CVE-2016-6641](https://cve.now/CVE-2016-6641.md): Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 3.7.2 allows remote authenticated users to inject arbitrary web script or HT (no CVSS) - [CVE-2016-6642](https://cve.now/CVE-2016-6642.md): Cross-site request forgery (CSRF) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to hijack the authentication of adminis (no CVSS) - [CVE-2016-6643](https://cve.now/CVE-2016-6643.md): Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to inject arbitrary web script or HTML via uns (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-09-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.