# CVEs published 2016-09-26

57 CVEs were published on September 26, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-6309](https://cve.now/CVE-2016-6309.md): statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a den (no CVSS)
- [CVE-2016-7052](https://cve.now/CVE-2016-7052.md): crypto/x509/x509\_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application cras (no CVSS)
- [CVE-2016-6038](https://cve.now/CVE-2016-6038.md): Directory traversal vulnerability in Eclipse Help in IBM Tivoli Lightweight Infrastructure (aka LWI), as used in AIX 5.3, 6.1, and 7.1, allo (no CVSS)
- [CVE-2016-6980](https://cve.now/CVE-2016-6980.md): Use-after-free vulnerability in Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code via unspecified vectors, a di (no CVSS)
- [CVE-2016-3639](https://cve.now/CVE-2016-3639.md): SAP HANA DB 1.00.091.00.1418659308 allows remote attackers to obtain sensitive topology information via an unspecified HTTP request, aka SAP (no CVSS)
- [CVE-2016-4972](https://cve.now/CVE-2016-4972.md): OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka) (no CVSS, murano · murano-dashboard +1)
- [CVE-2016-6142](https://cve.now/CVE-2016-6142.md): SAP HANA DB 1.00.73.00.389160 (NewDB100\_REL) allows remote attackers to inject arbitrary audit trail fields into the SYSLOG via vectors rela (no CVSS)
- [CVE-2016-6172](https://cve.now/CVE-2016-6172.md): PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and (no CVSS)
- [CVE-2016-6826](https://cve.now/CVE-2016-6826.md): Huawei AnyMail before 2.6.0301.0060 allows remote attackers to cause a denial of service (application crash) via a crafted compressed email (no CVSS)
- [CVE-2016-6827](https://cve.now/CVE-2016-6827.md): Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated users to obtain sensiti (no CVSS)
- [CVE-2016-6901](https://cve.now/CVE-2016-6901.md): Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with soft (no CVSS)
- [CVE-2016-6913](https://cve.now/CVE-2016-6913.md): Cross-site scripting (XSS) vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2016-5746](https://cve.now/CVE-2016-5746.md): libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary file on disk, which mi (no CVSS)
- [CVE-2016-6518](https://cve.now/CVE-2016-6518.md): Memory leak in Huawei S9300, S5300, S5700, S6700, S7700, S9700, and S12700 devices allows remote attackers to cause a denial of service (mem (no CVSS)
- [CVE-2016-7142](https://cve.now/CVE-2016-7142.md): The m\_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL\_EXTERNAL authentication, allows remote attackers to (no CVSS)
- [CVE-2016-7162](https://cve.now/CVE-2016-7162.md): The \_g\_file\_remove\_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files (no CVSS)
- [CVE-2016-3110](https://cve.now/CVE-2016-3110.md): mod\_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an (no CVSS, org.jboss.mod\_cluster:mod\_cluster-parent)
- [CVE-2016-4303](https://cve.now/CVE-2016-4303.md): The parse\_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2016-4993](https://cve.now/CVE-2016-4993.md): CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7. (no CVSS, org.wildfly:wildfly-undertow)
- [CVE-2016-5395](https://cve.now/CVE-2016-5395.md): Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remo (no CVSS, org.apache.ranger:ranger)
- [CVE-2016-5406](https://cve.now/CVE-2016-5406.md): The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain priv (no CVSS)
- [CVE-2016-6276](https://cve.now/CVE-2016-6276.md): Citrix Linux Virtual Delivery Agent (aka VDA, formerly Linux Virtual Desktop) before 1.4.0 allows local users to gain root privileges via un (no CVSS)
- [CVE-2016-6840](https://cve.now/CVE-2016-6840.md): Cross-site scripting (XSS) vulnerability in the management interface in Huawei OceanStor ISM before V200R001C04SPC200 allows remote attacker (no CVSS)
- [CVE-2016-7098](https://cve.now/CVE-2016-7098.md): Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to b (no CVSS)
- [CVE-2016-8279](https://cve.now/CVE-2016-8279.md): The video driver in Huawei Mate S smartphones with software CRR-TL00 before CRR-TL00C01B362, CRR-UL20 before CRR-UL20C00B362, CRR-CL00 befor (no CVSS)
- [CVE-2016-0248](https://cve.now/CVE-2016-0248.md): IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information f (no CVSS)
- [CVE-2016-0379](https://cve.now/CVE-2016-0379.md): IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a den (no CVSS)
- [CVE-2016-2999](https://cve.now/CVE-2016-2999.md): IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sensitive information vi (no CVSS)
- [CVE-2016-3000](https://cve.now/CVE-2016-3000.md): The help service in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to cause a den (no CVSS)
- [CVE-2016-3001](https://cve.now/CVE-2016-3001.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows rem (no CVSS)
- [CVE-2016-3003](https://cve.now/CVE-2016-3003.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows rem (no CVSS)
- [CVE-2016-3006](https://cve.now/CVE-2016-3006.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows rem (no CVSS)
- [CVE-2016-3007](https://cve.now/CVE-2016-3007.md): Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote aut (no CVSS)
- [CVE-2016-3040](https://cve.now/CVE-2016-3040.md): IBM WebSphere Application Server (WAS) Liberty, as used in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0 (no CVSS)
- [CVE-2016-5943](https://cve.now/CVE-2016-5943.md): IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to bypass intended (no CVSS)
- [CVE-2016-5944](https://cve.now/CVE-2016-5944.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5. (no CVSS)
- [CVE-2016-5945](https://cve.now/CVE-2016-5945.md): IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to upload non-execu (no CVSS)
- [CVE-2016-5946](https://cve.now/CVE-2016-5946.md): Directory traversal vulnerability in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote au (no CVSS)
- [CVE-2016-5947](https://cve.now/CVE-2016-5947.md): IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to conduct clickjac (no CVSS)
- [CVE-2016-5957](https://cve.now/CVE-2016-5957.md): IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote attackers to defeat cryptographic prot (no CVSS)
- [CVE-2016-5963](https://cve.now/CVE-2016-5963.md): IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, which allows rem (no CVSS)
- [CVE-2016-5970](https://cve.now/CVE-2016-5970.md): Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote a (no CVSS)
- [CVE-2016-5971](https://cve.now/CVE-2016-5971.md): IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary (no CVSS)
- [CVE-2016-5972](https://cve.now/CVE-2016-5972.md): IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspecified resources, whi (no CVSS)
- [CVE-2016-5974](https://cve.now/CVE-2016-5974.md): Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0. (no CVSS)
- [CVE-2016-5975](https://cve.now/CVE-2016-5975.md): Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 befo (no CVSS)
- [CVE-2016-5976](https://cve.now/CVE-2016-5976.md): The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, (no CVSS)
- [CVE-2016-5977](https://cve.now/CVE-2016-5977.md): Open redirect vulnerability in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 an (no CVSS)
- [CVE-2016-5978](https://cve.now/CVE-2016-5978.md): Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 befo (no CVSS)
- [CVE-2016-5996](https://cve.now/CVE-2016-5996.md): The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, (no CVSS)
- [CVE-2016-5997](https://cve.now/CVE-2016-5997.md): The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, (no CVSS)
- [CVE-2016-6153](https://cve.now/CVE-2016-6153.md): os\_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain se (no CVSS)
- [CVE-2016-6304](https://cve.now/CVE-2016-6304.md): Multiple memory leaks in t1\_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a d (no CVSS)
- [CVE-2016-6305](https://cve.now/CVE-2016-6305.md): The ssl3\_read\_bytes function in record/rec\_layer\_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (i (no CVSS)
- [CVE-2016-6306](https://cve.now/CVE-2016-6306.md): The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bo (no CVSS)
- [CVE-2016-6307](https://cve.now/CVE-2016-6307.md): The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow (no CVSS)
- [CVE-2016-6308](https://cve.now/CVE-2016-6308.md): statem/statem\_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, whi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-09-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.